~ / search / GHSA-hc6q-2mpp-qw7j

GHSA-hc6q-2mpp-qw7j

Cross-realm object access in Webpack 5

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-28154

Packages

EcosystemPackageAffectedFixed in
npm webpack >= 5.0.0, < 5.76.0 5.76.0

Details

As written in the advisory (Markdown source, shown as plain text).

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

References

External links from the advisory. They lead to third-party sites.