Skip to content
Fencer Vulns
critical 9.8

CVE-2023-28154 json

Cross-realm object access in Webpack 5

published 2023-03-13 3 y ago modified 2026-06-17 4 mo ago also GHSA-hc6q-2mpp-qw7j , EUVD-2023-1030

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits
0
none known

Summary

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

Patch / fix

  • npm webpack 5.76.0
  • webpack.js webpack 5.76.0
  • node-webpack Debian 12 5.75.0+dfsg+~cs17.16.14-1+deb12u1
  • node-webpack Debian 14, Debian 13 5.76.1+dfsg1+~cs17.16.16-1

debian advisories DEBIAN-CVE-2023-28154

  • pcs RHEL 9 0.11.3-4.el9_1.3
  • pcs-snmp RHEL 9 0.11.3-4.el9_1.3

red hat advisories RHSA-2023:1591

  • agama-web-ui openSUSE Tumbleweed 9+52-1.1
  • cockpit-d-installer openSUSE Tumbleweed 0.8.1~1-5.1
  • cockpit-agama openSUSE Tumbleweed 2.1+0-1.1

opensuse advisories openSUSE-SU-2024:14106-1openSUSE-SU-2024:12803-1openSUSE-SU-2024:12979-1

  • pcs AlmaLinux 9 0.11.4-7.el9_2
  • pcs-snmp AlmaLinux 9 0.11.4-7.el9_2
  • pcs AlmaLinux 9 0.11.3-4.el9_1.3
  • pcs-snmp AlmaLinux 9 0.11.3-4.el9_1.3

almalinux advisories ALSA-2023:2652ALSA-2023:1591

  • pcs Rocky Linux 9 0.11.3-4.el9_1.3

rocky linux advisories RLSA-2023:1591

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-28154 updated cvss 9.1

webpack: avoid cross-realm objects

  • Red Hat OpenShift Developer Tools and Services odo Red Hat A-MQ Online webpack Red Hat OpenShift Container Platform 4 openshift4/ose-monitoring-plugin-rhel9 Red Hat OpenShift Dev Spaces devspaces-theia-rhel8-container Red Hat Quay 3 quay/quay-rhel8
    affected: no fix available
  • Red Hat OpenShift Pipelines version 1.10 for RHEL 8 openshift-pipelines/pipelines-hub-ui-rhel8 v1.10.5-2
    fixed: vendor fix RHBA-2023:4315
  • Red Hat Enterprise Linux High Availability (v. 9) pcs 0.11.3-4.el9_1.3, pcs-snmp 0.11.3-4.el9_1.3 Red Hat Enterprise Linux Resilient Storage (v. 9) pcs 0.11.3-4.el9_1.3, pcs-snmp 0.11.3-4.el9_1.3
    fixed: vendor fix RHSA-2023:1591
  • Red Hat OpenShift Pipelines version 1.10 for RHEL 8 openshift-pipelines/pipelines-nop-rhel8 v1.10.5-15, openshift-pipelines/pipelines-cli-tkn-rhel8 v1.10.5-3, openshift-pipelines/pipelines-hub-api-rhel8 v1.10.5-4, openshift-pipelines/pipelines-webhook-rhel8 v1.10.5-14, openshift-pipelines/pipelines-git-init-rhel8 v1.10.5-15, openshift-pipelines/pipelines-rhel8-operator v1.10.5-15, +17 more Red Hat OpenShift Service Mesh 2.1 servicemesh-grafana, servicemesh-prometheus Red Hat Ansible Automation Platform 2 aap-azure-ui Red Hat build of Apicurio Registry 2 webpack Red Hat Data Grid 8 webpack Red Hat Decision Manager 7 webpack
    +10 more products
    Red Hat Enterprise Linux 6 firefox Red Hat Enterprise Linux 7 firefox Red Hat Enterprise Linux 8 pcs, grafana, mozjs60, pcs-snmp, grafana-pcp, grafana-loki, +13 more Red Hat Enterprise Linux 9 gjs, polkit, grafana, polkit-libs, grafana-selinux, js-d3-flame-graph Red Hat Fuse 7 webpack Red Hat Integration Camel K 1 webpack Red Hat JBoss Enterprise Application Platform 7 io.smallrye-smallrye-open-api-parent Red Hat JBoss Enterprise Application Platform Expansion Pack io.smallrye-smallrye-open-api-parent Red Hat Process Automation 7 webpack Red Hat Satellite 6 rubygem-rabl, nodejs-webpack
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
20 mo ago

Exploit prediction

1.41% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
npm webpack
>=5.0.0, <5.76.0
5.76.0

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.