CVE-2023-28154 Cross-realm object access in Webpack 5
An attacker controlling an untrusted object property can access the real global object in Webpack, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-28154?
CVE-2023-28154 is a critical vulnerability in n/a, published on 13 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.
Which versions are affected by CVE-2023-28154?
2 open source packages ship an affected version, including webpack. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
webpack npm | From 5.0.0 | 5.76.0 |
webpack npm | From 5.0.0 | 5.76.0 |
Linux distribution packages (10)
pcs AlmaLinux:9 | All versions | 0.11.3-4.el9_1.3 |
pcs-snmp AlmaLinux:9 | All versions | 0.11.3-4.el9_1.3 |
pcs Red Hat:enterprise_linux:9::highavailability | All versions | 0:0.11.3-4.el9_1.3 |
pcs-snmp Red Hat:enterprise_linux:9::highavailability | All versions | 0:0.11.3-4.el9_1.3 |
pcs Red Hat:enterprise_linux:9::resilientstorage | All versions | 0:0.11.3-4.el9_1.3 |
pcs-snmp Red Hat:enterprise_linux:9::resilientstorage | All versions | 0:0.11.3-4.el9_1.3 |
pcs Rocky Linux:9 | All versions | 0:0.11.3-4.el9_1.3 |
agama-web-ui openSUSE:Tumbleweed | All versions | 9+52-1.1 |
cockpit-agama openSUSE:Tumbleweed | All versions | 2.1+0-1.1 |
cockpit-d-installer openSUSE:Tumbleweed | All versions | 0.8.1~1-5.1 |
Products include Webpack.js Webpack.
How do I fix CVE-2023-28154?
Upgrade webpack to 5.76.0 or later.
Is CVE-2023-28154 being exploited?
There is no known exploitation of CVE-2023-28154 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2024-43788 DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS)
- CVE-2025-68157 webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects
- CVE-2025-68458 webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior
Sources
Also known as ALSA-2023:1591, DEBIAN-CVE-2023-28154, GHSA-hc6q-2mpp-qw7j, RHSA-2023:1591, RLSA-2023:1591, ROOT-APP-NPM-CVE-2023-28154 and 4 more.