Packages / webpack / Security

CriticalVulnerabilityGHSA-hc6q-2mpp-qw7jCVE-2023-28154Published 13 Mar 2023

Cross-realm object access in Webpack 5

Affected releases · webpack

  • 5.x5.0.0 – 5.75.0Fixed in 5.76.0

On 5.x, the newest line:

npm install webpack@5.76.0

  1. Not affected

    0.1.0 – 4.47.0

    362 releases

  2. Affected

    5.0.0 – 5.75.0

    135 releases

  3. Fixed

    5.76.0 – 5.112.0

    86 releases, latest

583 stable releases of webpack, oldest to newest.

Is your project affected?

Paste your package.json, or type the range you declare for webpack. It is read in your browser and sent nowhere.

What happens

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.