CVE-2023-28154

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

• https://github.com/webpack/webpack/compare/v5.75.0...v5.76.0Patch, Product
• https://github.com/webpack/webpack/pull/16500Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AU7BOXTBK3KDYSWH67ASZ22TUIOZ3X5G/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PPSAXUTXBCCTAHTCX5BUR4YVP25XALQ3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2AFCM6FFE3LRYI6KNEQWKMXMQOBZQ2D/
• https://github.com/webpack/webpack/compare/v5.75.0...v5.76.0Patch, Product
• https://github.com/webpack/webpack/pull/16500Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AU7BOXTBK3KDYSWH67ASZ22TUIOZ3X5G/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PPSAXUTXBCCTAHTCX5BUR4YVP25XALQ3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2AFCM6FFE3LRYI6KNEQWKMXMQOBZQ2D/

Published

Mar 13, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28149An issue was discovered in the IhisiServiceSmm module in Ins…6.1
• CVE-2023-2815A vulnerability classified as critical was found in SourceCo…9.8
• CVE-2023-28150An issue was discovered in Independentsoft JODF before 1.1.1…9.8
• CVE-2023-28151An issue was discovered in Independentsoft JSpreadsheet befo…9.8
• CVE-2023-28152An issue was discovered in Independentsoft JWord before 1.1.…9.8
• CVE-2023-28153An issue was discovered in the Kiddoware Kids Place Parental…6.4
• CVE-2023-28155The Request package through 2.88.1 for Node.js allows a bypa…6.1
• CVE-2023-28158Privilege escalation via stored XSS using the file upload se…5.4
• CVE-2023-28159The fullscreen notification could have been hidden on Firefo…4.3
• CVE-2023-2816Consul and Consul Enterprise allowed any user with service:w…6.5
• CVE-2023-28160When following a redirect to a publicly accessible web exten…6.5
• CVE-2023-28161If temporary "one-time" permissions, such as the ability to …8.8