Remote Code Execution Vulnerability in react-dev-utils by Facebook
CVE-2018-6342

9.8CRITICAL

Key Information:

Vendor

Facebook

Status
React-dev-utils
Vendor
CVE Published:
31 December 2018

What is CVE-2018-6342?

The react-dev-utils component in the React ecosystem allows developers to create a local web server for executing commands, including launching an editor. An improper sanitization of command input creates a risk where an attacker, through either Cross-Site Request Forgery (CSRF) or direct network requests, could exploit this vulnerability to execute arbitrary commands on the server. This issue can affect various versions if they are not updated, creating potential entry points for malicious activities.

Affected Version(s)

react-dev-utils 5.0.2

react-dev-utils 5.0.0

react-dev-utils 4.2.2

References

https://github.com/facebook/create-react-app/releases/tag...
x_refsource_MISC
https://github.com/facebook/create-react-app/pull/4866
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.