CriticalGHSA-hc6q-2mpp-qw7jCVE-2023-28154

Cross-realm object access in Webpack 5

Published 13 Mar 2023 · Updated 8 Nov 2023

Affected package

webpacknpm
Affected
>=5.0.0 <5.76.0
Fixed in
5.76.0
Update to the fixed version for your release line, for example:npm install webpack@5.76.0

Details

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

Is GHSA-hc6q-2mpp-qw7j in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected webpack, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.