GHSA-hc6q-2mpp-qw7j
Suggest an improvement- Source
- https://github.com/advisories/GHSA-hc6q-2mpp-qw7j
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-hc6q-2mpp-qw7j/GHSA-hc6q-2mpp-qw7j.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-hc6q-2mpp-qw7j
- Aliases
- Published
- 2023-03-13T03:30:15Z
- Modified
- 2023-11-08T04:12:09.414542Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Cross-realm object access in Webpack 5
- Details
-
Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2023-28154
- https://github.com/webpack/webpack/pull/16500
- https://github.com/webpack/webpack/compare/v5.75.0...v5.76.0
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AU7BOXTBK3KDYSWH67ASZ22TUIOZ3X5G
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PPSAXUTXBCCTAHTCX5BUR4YVP25XALQ3
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U2AFCM6FFE3LRYI6KNEQWKMXMQOBZQ2D
Affected packages
npm / webpack
Package
- Name
- webpack
- View open source insights on deps.dev
- Purl
- pkg:npm/webpack