Vulnerability CVE-2023-28154

Vulnerability CVE-2023-28154

Published: 2023-03-13

Description:

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

References:

https://github.com/webpack/webpack/compare/v5.75.0...v5.76.0

https://github.com/webpack/webpack/pull/16500

Copyright 2026, cxsecurity.com