Every CVE Search/ Get API key

CVE-2023-28154

Cross-realm object access in Webpack 5

9.8 CriticalFix available

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.41%Up 1.4 points since Mar 13, 2023
90%50%10%1%

What each source reports

NVD Score used 9.8

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

Record
CVE-2023-28154
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
CVE List 9.8

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

Record
CVE-2023-28154
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
EUVDEUVD-2023-1030 9.8

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

Record
EUVD-2023-1030
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-hc6q-2mpp-qw7j 9.8

Cross-realm object access in Webpack 5

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

Record
GHSA-hc6q-2mpp-qw7j
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 9.8

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

Record
CVE-2023-28154
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2023-28154 9.8

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

Record
DEBIAN-CVE-2023-28154
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 10 moreShow less
OSVGHSA-hc6q-2mpp-qw7j 9.8

Cross-realm object access in Webpack 5

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

Record
GHSA-hc6q-2mpp-qw7j
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:1591 9.1

Red Hat Security Advisory: pcs security update

Record
RHSA-2023:1591
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2023-28154 9.8

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

Record
UBUNTU-CVE-2023-28154
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2023:1591 No score

Important: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

  • webpack: avoid cross-realm objects (CVE-2023-28154)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:1591
Updated
2026-11-02
OSVALSA-2023:2652 No score

Important: pcs security and bug fix update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

  • pcs: webpack: Regression of CVE-2023-28154 fixes in the AlmaLinux (CVE-2023-2319)
  • rubygem-rack: Denial of service in Multipart MIME parsing (CVE-2023-27530)
  • rubygem-rack: denial of service in header parsing (CVE-2023-27539)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • Command 'pcs config checkpoint diff' does not show configuration differences between checkpoints (BZ#2180697)
  • Need a way to add a scsi fencing device to a cluster without requiring a restart of all cluster resources (BZ#2180704)
  • [WebUI] fence levels prevent loading of cluster status (BZ#2183180)
Record
ALSA-2023:2652
Updated
2026-11-02
OSVopenSUSE-SU-2024:12803-1 No score

cockpit-d-installer-0.8.1~1-5.1 on GA media

These are all security issues fixed in the cockpit-d-installer-0.8.1~1-5.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12803-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12979-1 No score

cockpit-agama-2.1+0-1.1 on GA media

These are all security issues fixed in the cockpit-agama-2.1+0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12979-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14106-1 No score

agama-web-ui-9+52-1.1 on GA media

These are all security issues fixed in the agama-web-ui-9+52-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14106-1
Updated
2026-11-02
OSVRLSA-2023:1591 No score

Important: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

  • webpack: avoid cross-realm objects (CVE-2023-28154)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2023:1591
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2023-28154 No score

CVE-2023-28154 in webpack - Patched by Root

Root has patched CVE-2023-28154 in the webpack package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2023-28154
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
webpack
npm
 5.0.0 up to 5.76.0
5.76.0
pcs
AlmaLinux:9
 before 0.11.3-4.el9_1.3
0.11.3-4.el9_1.3
pcs-snmp
AlmaLinux:9
 before 0.11.3-4.el9_1.3
0.11.3-4.el9_1.3
pcs
AlmaLinux:9
From an advisory covering 4 CVEs
 before 0.11.4-7.el9_2
0.11.4-7.el9_2
pcs-snmp
AlmaLinux:9
From an advisory covering 4 CVEs
 before 0.11.4-7.el9_2
0.11.4-7.el9_2
node-webpack
Debian:12
 before 5.75.0+dfsg+~cs17.16.14-1+deb12u1, plus listed versions
5.75.0+dfsg+~cs17.16.14-1
5.75.0+dfsg+~cs17.16.14-1+deb12u1
node-webpack
Debian:13
 before 5.76.1+dfsg1+~cs17.16.16-1
5.76.1+dfsg1+~cs17.16.16-1
node-webpack
Debian:14
 before 5.76.1+dfsg1+~cs17.16.16-1
5.76.1+dfsg1+~cs17.16.16-1
pcs
Red Hat:enterprise_linux:9::highavailability
 before 0:0.11.3-4.el9_1.3
0:0.11.3-4.el9_1.3
pcs-snmp
Red Hat:enterprise_linux:9::highavailability
 before 0:0.11.3-4.el9_1.3
0:0.11.3-4.el9_1.3
Show 15 moreShow less
Affected packages
PackageAffectedFixed
pcs
Red Hat:enterprise_linux:9::resilientstorage
 before 0:0.11.3-4.el9_1.3
0:0.11.3-4.el9_1.3
pcs-snmp
Red Hat:enterprise_linux:9::resilientstorage
 before 0:0.11.3-4.el9_1.3
0:0.11.3-4.el9_1.3
pcs
Rocky Linux:9
 before 0:0.11.3-4.el9_1.3
0:0.11.3-4.el9_1.3
webpack
Root:npm
 before 5.75.0-aikido.1
5.75.0-aikido.1
@rootio/webpack
Root:npm
 before 5.75.0-root.io.1
5.75.0-root.io.1
node-webpack
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.5.6-1build33.5.6-1build43.5.6-2
 None known
node-webpack
Ubuntu:20.04:LTS
 All versions, plus listed versions
4.7.0-34.30.0-74.30.0-9
 None known
node-webpack
Ubuntu:22.04:LTS
 All versions, plus listed versions
4.43.0-6build44.43.0-7
 None known
node-webpack
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.76.1+dfsg1+~cs17.16.16-1
 None known
node-webpack
Ubuntu:25.10
 All versions, plus listed versions
5.97.1+dfsg1+~cs11.18.27-25.97.1+dfsg1+~cs11.18.27-3
 None known
node-webpack
Ubuntu:26.10
 All versions, plus listed versions
5.105.4+dfsg1+~cs15.13.23-25.108.0+dfsg1+~cs14.7.20-2
 None known
node-webpack
Ubuntu:26.04:LTS
 All versions, plus listed versions
5.97.1+dfsg1+~cs11.18.27-35.97.1+dfsg1+~cs11.18.27-45.105.4+dfsg1+~cs15.13.23-2
 None known
cockpit-d-installer
openSUSE:Tumbleweed
 before 0.8.1~1-5.1
0.8.1~1-5.1
cockpit-agama
openSUSE:Tumbleweed
 before 2.1+0-1.1
2.1+0-1.1
agama-web-ui
openSUSE:Tumbleweed
 before 9+52-1.1
9+52-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-28154 is a critical vulnerability (CVSS 9.8) in Webpack.js Webpack, published March 13, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.41%, the 72nd percentile. Fixed in webpack 5.76.0.

References

Show 25 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open