44 matches found
CVE-2026-14802
CVE-2026-14802 Name of the Vulnerable Software and Affected Versions create-react-app versions prior to 5.0.2 Description On macOS, the startBrowserProcess function within the openBrowser.js file of the react-dev-utils component allows for OS command injection. This issue enables remote...
OS Command Injection
React create-react-app is vulnerable to OS command injection. The vulnerability is due to improper handling of input in the startBrowserProcess function of openBrowser.js in react-dev-utils, which allows an attacker to manipulate the input and execute arbitrary operating system commands remotely...
Exploit for CVE-2026-14802
CVE-2026-14802 Name of the Vulnerable Software and Affected Ve...
GHSA-G9G6-GVQ9-J4VP react-dev-utils openBrowser permits command injection on macOS
A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProcess of the file openBrowser.js of the component react-dev-utils. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The...
react-dev-utils openBrowser permits command injection on macOS
A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProcess of the file openBrowser.js of the component react-dev-utils. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The...
@1337lawyers/design (>=0.1.0, <=0.1.38), @9188/w-cli (>=1.0.0, <=1.0.4) +50 more potentially affected by CVE-2026-14802 via react-dev-utils (>=5.0.0, <=5.0.1)
react-dev-utils NPM version =5.0.0, =0.1.0, =1.0.0, =0.4.1, =0.1.0-latest.1a450bb3, =1.0.5, =1.0.0-beta.28, =1.0.1, =1.0.0, =1.0.0, =0.26.4, =0.0.0-legacy, =3.10.0-beta.0, =0.1.0-alpha.0, =2.1.16, =2.3.5 - aqxy-common-ui 0.0.1 and more Source cves: CVE-2026-14802 Source advisory:...
-react-file-list-components (1.1.1), -tompan-reacttemplate (>=1.0.1, <=1.1.0) +41012 more potentially affected by CVE-2026-14802 via react-dev-utils (>=0.1.1, <=12.1.0-next.26)
react-dev-utils NPM version =0.1.1, =1.0.1, =0.1.0, =0.1.0, =0.1.6 - 0beny1s 1.1.6 - 0scarclassa 1.0.1 - 0scarclassb 1.0.1 - 0scarclassc 1.0.1 - 0scarclassd 1.0.1 - 0scarclasse 1.0.1 - 0scarclassf 1.0.1 - 0scarclassg 1.0.1 - 0scarclassh 1.0.1 - 0scarclassi 1.0.1 and more Source cves: CVE-2026-148...
Command Injection
Overview org.webjars.npm:react-dev-utils is an includes some utilities used by Create React App. Affected versions of this package are vulnerable to Command Injection via the startBrowserProcess function in react-dev-utils/openBrowser.js. An attacker can execute arbitrary operating system command...
Command Injection
Overview react-dev-utils is an includes some utilities used by Create React App. Affected versions of this package are vulnerable to Command Injection via the startBrowserProcess function in react-dev-utils/openBrowser.js. An attacker can execute arbitrary operating system commands by supplying...
CVE-2026-14802
A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProcess of the file openBrowser.js of the component react-dev-utils. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The...
CVE-2026-14802
CVE-2026-14802 affects react-create-app releases up to 5.0.1 on macOS, targeting the startBrowserProcess function in openBrowser.js within react-dev-utils. The root cause is an input manipulation that enables OS command injection, with remote exploitation described as possible and the exploit pub...
EUVD-2026-41815
A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProcess of the file openBrowser.js of the component react-dev-utils. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The...
CVE-2026-14802 react create-react-app react-dev-utils openBrowser.js startBrowserProcess os command injection
A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProcess of the file openBrowser.js of the component react-dev-utils. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The...
PT-2026-105512
A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProcess of the file openBrowser.js of the component react-dev-utils. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The...
PT-2026-55871
A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProcess of the file openBrowser.js of the component react-dev-utils. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The...
CVE-2026-14802: Improper Neutralization of Special Elements used in an OS Command
A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProcess of the file openBrowser.js of the component react-dev-utils. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The...
CVE-2025-67779
creationtimestamp| type| source ---|---|--- 2025-12-05 13:54:28+00:00| seen| https://vulnerability.circl.lu/bundle/6739b288-995a-4f1a-9f03-5d1ced3a8fbd 2025-12-12 00:04:32+00:00| seen| https://bsky.app/profile/react.dev/post/3m7qs2rtey22l 2025-12-12 02:04:06+00:00| seen|...
CVE-2025-55183
creationtimestamp| type| source ---|---|--- 2025-12-05 13:54:28+00:00| seen| https://vulnerability.circl.lu/bundle/6739b288-995a-4f1a-9f03-5d1ced3a8fbd 2025-12-11 20:51:04+00:00| seen| https://bsky.app/profile/react.dev/post/3m7qhaqdtxc2v 2025-12-11 20:51:05+00:00| seen|...
CVE-2025-55184
creationtimestamp| type| source ---|---|--- 2025-12-05 13:54:28+00:00| seen| https://vulnerability.circl.lu/bundle/6739b288-995a-4f1a-9f03-5d1ced3a8fbd 2025-12-11 20:51:04+00:00| seen| https://bsky.app/profile/react.dev/post/3m7qhaqdxuc2v 2025-12-11 20:51:04+00:00| seen|...