Read the docs
TI-2023-12725 Aliases CVE-2023-28154GHSA-hc6q-2mpp-qw7j

Webpack 5 before 5.76.0 does not avoid cross-realm object access.

Priority MEDIUM 52Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 3 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.

Summary

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01409 72nd percentileScored 2026-11-07
Fix Partial webpack (npm): 5.76.0Red Hat: 1 advisoryRed Hat: 3 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—webpack (npm)5.0.0 to before 5.76.05.76.0Patch availableGHSA-hc6q-2mpp-qw7j
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • webpack (npm) Vendor— Affected 5.0.0 to before 5.76.0 Fixed in 5.76.0 Patch available GHSA-hc6q-2mpp-qw7j

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:webpack.js:webpack:*:*:*:*:*:node.js:*:*5.0.0 to before 5.76.0Vulnerablewebpack
  • cpe:2.3:a:webpack.js:webpack:*:*:*:*:*:node.js:*:* Versions 5.0.0 to before 5.76.0 Vulnerable ·webpack

Remediation

  • Fix · GHSA-hc6q-2mpp-qw7j webpack (npm) Fixed in 5.76.0 Advisory →

Red Hat 1 advisory

  • RHSA-2023:1591 Released 2023-04-04 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability (v. 9) pcs-0.11.3-4.el9_1.3, pcs-snmp-0.11.3-4.el9_1.3
    • Red Hat Enterprise Linux Resilient Storage (v. 9) pcs-0.11.3-4.el9_1.3, pcs-snmp-0.11.3-4.el9_1.3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix yet
Red Hat A-MQ OnlineAffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
OpenShift Pipelines version 1.10 for RHEL 8Fixed—
Red Hat Enterprise Linux High Availability (v. 9)Fixed RHSA-2023:1591
Red Hat Enterprise Linux Resilient Storage (v. 9)Fixed RHSA-2023:1591
Not affected: 16 products
  • OpenShift Pipelines version 1.10 for RHEL 8
  • OpenShift Service Mesh 2.1
  • Red Hat Ansible Automation Platform 2
  • Red Hat Data Grid 8
  • Red Hat Decision Manager 7
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Process Automation 7
  • Red Hat Satellite 6
  • Red Hat build of Apicurio Registry 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-28154
  2. 2026-10-03 Alias added: GHSA-hc6q-2mpp-qw7j

References

Patch 2

Advisory 4

Other 3

  • TI-2024-29382 DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS) CVSS 3.1MEDIUM 6.4
  • TI-2025-41991 webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior CVSS 3.1LOW 3.7
  • TI-2025-41737 webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects CVSS 3.1LOW 3.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences