react-dev-utils on Windows vulnerable to Remote Code Execution

2019-01-0417:41:20

Google

osv.dev

0.002 Low

EPSS

Percentile

56.8%

JSON

react-dev-utils on Windows is vulnerable to remote code execution.

Recommendation

Update to one of the following versions, depending on the release line that you are using.

1.0.4
2.0.2
3.1.2
4.2.2
5.0.2
6.0.0-next.a671462c

CPENameOperatorVersion
react-dev-utilslt4.2.2
react-dev-utilsge5.0.0
react-dev-utilsge1.0.0
react-dev-utilslt1.0.4
react-dev-utilsge2.0.0
react-dev-utilsge4.0.0
react-dev-utilslt3.1.2
react-dev-utilslt2.0.2
react-dev-utilslt5.0.2
react-dev-utilsge3.0.0

Name	Operator	Version
react-dev-utils	lt	4.2.2
react-dev-utils	ge	5.0.0
react-dev-utils	ge	1.0.0
react-dev-utils	lt	1.0.4
react-dev-utils	ge	2.0.0
react-dev-utils	ge	4.0.0
react-dev-utils	lt	3.1.2
react-dev-utils	lt	2.0.2
react-dev-utils	lt	5.0.2
react-dev-utils	ge	3.0.0