3vulnerabilities
- Critical0 (0.0%)
- High1 (33.3%)
- Medium0 (0.0%)
- Moderate2 (66.7%)
- Low0 (0.0%)
react-dev-utils
Ecosystem: npm
Downloads: 17.22 Mln
- 0CriticalAffects 0 versions
- 1HighAffects 5 versions
- 0MediumAffects 0 versions
- 2ModerateAffects 2 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (3)
Known vulnerabilities affecting react-dev-utils, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-g9g6-gvq9-j4vp | Moderate | react-dev-utils openBrowser permits command injection on macOSA vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProcess of the file openBrowser.js of the component react-dev-utils. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet. |
| GitHub (opens in a new tab) | |
| GHSA-5q6m-3h65-w53x | Moderate | react-dev-utils OS Command Injection in function `getProcessForPort`react-dev-utils prior to v11.0.4 exposes a function, `getProcessForPort`, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. Only when this function is manually invoked with user-provided values (ie: by custom code) is there the potential for command injection. If you're consuming it from react-scripts then this issue does not affect you. |
| GitHub (opens in a new tab) | |
| GHSA-29gp-92wp-94q8 | High | react-dev-utils on Windows vulnerable to Remote Code Execution`react-dev-utils` on Windows is vulnerable to remote code execution. ## Recommendation Update to one of the following versions, depending on the release line that you are using. - 1.0.4 - 2.0.2 - 3.1.2 - 4.2.2 - 5.0.2 - 6.0.0-next.a671462c |
| GitHub (opens in a new tab) |
- GHSA-g9g6-gvq9-j4vpModeratereact-dev-utils openBrowser permits command injection on macOS
<= 5.0.1
A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProcess of the file openBrowser.js of the component react-dev-utils. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE: CVE-2026-14802
- GHSA-5q6m-3h65-w53xModeratereact-dev-utils OS Command Injection in function `getProcessForPort`
>= 0.4.0, < 11.0.4
react-dev-utils prior to v11.0.4 exposes a function, `getProcessForPort`, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. Only when this function is manually invoked with user-provided values (ie: by custom code) is there the potential for command injection. If you're consuming it from react-scripts then this issue does not affect you.
CVE: CVE-2021-24033
- GHSA-29gp-92wp-94q8Highreact-dev-utils on Windows vulnerable to Remote Code Execution
>= 1.0.0, < 1.0.4>= 2.0.0, < 2.0.2- +3 more
Affected versions:>= 1.0.0, < 1.0.4>= 2.0.0, < 2.0.2>= 3.0.0, < 3.1.2>= 4.0.0, < 4.2.2>= 5.0.0, < 5.0.2
`react-dev-utils` on Windows is vulnerable to remote code execution. ## Recommendation Update to one of the following versions, depending on the release line that you are using. - 1.0.4 - 2.0.2 - 3.1.2 - 4.2.2 - 5.0.2 - 6.0.0-next.a671462c
CVE: CVE-2018-6342