CVE-2023-28154

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object...

CVE-2023-28154

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object...

Webpack security vulnerabilities

Webpack is a module packager. Its primary purpose is to bundle JavaScript files for use in the browser, but it is also capable of converting, bundling, or packaging almost any resource or asset. A security vulnerability exists in Webpack version 5 up to and including 5.76.0 that stems from not...

CVE-2023-28154

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object...

CVE-2023-28154

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object...

CVE-2023-28154

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object...

CVE-2023-28154: Undefined Security Weakness

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object...

PT-2023-21600

Name of the Vulnerable Software and Affected Versions Webpack versions prior to 5.76.0 Description The issue concerns cross-realm object access. Specifically, the ImportParserPlugin.js mishandles the magic comment feature, allowing an attacker who controls a property of an untrusted object to...

@acanto/laravel-scripts (>=0.2.14, <=0.2.27), @adobe/helix-deploy (>=1.6.0, <=7.3.1) +1215 more potentially affected by CVE-2023-28154 via webpack (>=5.0.0, <=5.75.0)

webpack NPM version =5.0.0, =0.2.14, =1.6.0, =3.0.0, =1.0.44, =3.0.0-beta.6, =1.0.0-rc2, =2.0.5-beta.11, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.17-beta.7, =0.2.0, =0.0.0-dev-4fb73016-20210914-1634176750976, =0.1.5 - @akphi/dev-utils1 0.0.1 and more Source cves:...

CVE-2023-28154

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object...

CVE-2023-28154

CVE-2023-28154 affects Webpack 5 before 5.76.0. ImportParserPlugin.js mishandles the magic comment feature, allowing an attacker who controls a property of an untrusted object to obtain access to the real global object (cross-realm object access). CVSS v3.1 base score 9.8 (CRITICAL). Remediation:...

loader-utils: Regular expression denial of service

A flaw was found in loader-utils webpack library. When the url variable from interpolateName is set, the prototype can be polluted. This issue could lead to a regular expression Denial of Service ReDoS, affecting the availability of the affected component...

Malicious Package

Overview webpack-dev-server.legacy is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious Package

Overview webpack-cli.legacy is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packag...

Malicious Package

Overview @realty-front/webpack-utils is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if th...

Malicious Package

Overview copy-webpack-plugin-v6 is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious Package

Overview webpack-latest is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package wa...

Malicious Package

Overview @playgami/portal-webpack is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

loader-utils: Regular expression denial of service

A flaw was found in loader-utils webpack library. When the url variable from interpolateName is set, the prototype can be polluted. This issue could lead to a regular expression Denial of Service ReDoS, affecting the availability of the affected component...

MAL-2023-54 Malicious code in @playgami/portal-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02680029cc7be83ef6c68dbbaff4fb6d92bd8c1a71759092c1b7f625c99b786a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...