Remote Code Execution Vulnerability in react-dev-utils by Facebook
CVE-2018-6342

9.8CRITICAL

Key Information:

Vendor

Facebook

Status
React-dev-utils
Vendor
CVE Published:
31 December 2018

What is CVE-2018-6342?

The react-dev-utils component in the React ecosystem allows developers to create a local web server for executing commands, including launching an editor. An improper sanitization of command input creates a risk where an attacker, through either Cross-Site Request Forgery (CSRF) or direct network requests, could exploit this vulnerability to execute arbitrary commands on the server. This issue can affect various versions if they are not updated, creating potential entry points for malicious activities.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

react-dev-utils 5.0.2

react-dev-utils 5.0.0

react-dev-utils 4.2.2

References

https://github.com/facebook/create-react-app/releases/tag...
x_refsource_MISC
https://github.com/facebook/create-react-app/pull/4866
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.