Login Sign Up

CVE-2023-28154

9.8 CRITICAL

📋 TL;DR

This vulnerability in Webpack 5 allows attackers to bypass JavaScript realm isolation and access the global object through malicious magic comments. It affects applications using Webpack 5 for bundling JavaScript code, particularly those that process untrusted user input in build configurations. The high CVSS score reflects the potential for arbitrary code execution.

💻 Affected Systems

Products:
  • webpack
Versions: Webpack 5 versions before 5.76.0
Operating Systems: All
Default Config Vulnerable: ⚠️ Yes
Notes: Applications using Webpack 5 for bundling with magic comment features are vulnerable. The vulnerability requires attacker-controlled input in build configurations.

📦 What is this software?

Webpack by Webpack.js

View all CVEs affecting Webpack →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete system compromise, data theft, or ransomware deployment.

🟠

Likely Case

Arbitrary JavaScript execution in the context of the application, potentially leading to data exfiltration, privilege escalation, or lateral movement.

🟢

If Mitigated

Limited impact if proper input validation and sandboxing are implemented, though the vulnerability still presents a significant security risk.

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: MEDIUM

Exploitation requires attacker to control properties of untrusted objects in the build process. No public proof-of-concept has been released as of the advisory date.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 5.76.0

Vendor Advisory: https://github.com/webpack/webpack/compare/v5.75.0...v5.76.0

Restart Required: Yes

Instructions:

1. Update webpack dependency to version 5.76.0 or later. 2. Run 'npm update webpack' or 'yarn upgrade webpack'. 3. Rebuild and redeploy the application. 4. Test the application functionality after update.

🔧 Temporary Workarounds

Input Validation and Sanitization

all

Implement strict input validation for all user-controlled inputs that affect webpack configuration, particularly magic comments.

Disable Magic Comments

all

If magic comment features are not required, disable them in webpack configuration to remove the attack vector.

// In webpack.config.js: avoid using magic comments like /* webpackChunkName: "chunk-name" */

🧯 If You Can't Patch

  • Implement strict input validation and sanitization for all build configuration inputs.
  • Isolate build processes in sandboxed environments with minimal privileges.

🔍 How to Verify

Check if Vulnerable:

Check package.json or package-lock.json for webpack version. If version is 5.x and less than 5.76.0, the system is vulnerable.

Check Version:

npm list webpack | grep webpack OR npx webpack --version

Verify Fix Applied:

Verify webpack version is 5.76.0 or higher after update. Test application builds to ensure functionality remains intact.

📡 Detection & Monitoring

Log Indicators:

  • Unusual build failures
  • Suspicious magic comment patterns in build logs
  • Unexpected global object access attempts

Network Indicators:

  • Unusual outbound connections from build servers
  • Data exfiltration patterns from CI/CD systems

SIEM Query:

source="build-logs" AND ("webpack" OR "magic comment") AND (error OR failure OR suspicious)

📊 Metadata

CVE ID: CVE-2023-28154
CVSS v3 Score: 9.8 (CRITICAL)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: March 13, 2023
Last Updated: February 27, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON