CVE-2023-28154
1 advisory.
npm/webpack CVE-2023-28154: critical 9.8, EPSS 1.41%
Cross-realm object access in Webpack 5
Action: Upgrade webpack to 5.76.0 or later.
npm i webpack@5.76.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.0.0 | 5.76.0 | - |
Fixed versions
| 5.76.0 |
Sources
- osv: GHSA-hc6q-2mpp-qw7j
- https://nvd.nist.gov/vuln/detail/CVE-2023-28154
- https://github.com/webpack/webpack/pull/16500
- https://github.com/webpack/webpack/compare/v5.75.0...v5.76.0
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AU7BOXTBK3KDYSWH67ASZ22TUIOZ3X5G
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PPSAXUTXBCCTAHTCX5BUR4YVP25XALQ3
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U2AFCM6FFE3LRYI6KNEQWKMXMQOBZQ2D
CVE-2023-28154 · published · modified · JSON