CVE-2026-14802: Command Injection Vulnerability in react-dev-utils
Summary
CVE-2026-14802: react-dev-utils openBrowser permits command injection on macOS. Affects react-dev-utils versions < 5.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
react-dev-utils is a set of utilities for React applications, primarily used to facilitate development processes such as starting a development server and opening the application in a web browser. It is an essential package for developers using Create React App, providing tools that streamline the development workflow. However, a vulnerability has been identified in the openBrowser function, which can lead to command injection on macOS systems.
Vulnerability Detail
A command injection vulnerability exists in the startBrowserProcess function of openBrowser.js within the react-dev-utils package, affecting versions up to 5.0.1. This vulnerability allows an attacker to execute arbitrary commands on the operating system by manipulating the input parameters. The risk of remote exploitation is significant, as the exploit is publicly available. This vulnerability is classified under CWE-77, indicating improper neutralization of special elements used in a command ('command injection').
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the openBrowser function in your development workflow until you can update to a patched version. If you must use it, ensure that any input passed to the function is sanitized to prevent command injection.
Conclusion
The command injection vulnerability in react-dev-utils poses a significant risk to macOS users of the package. It is crucial to update to the patched version to mitigate this risk. Developers should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for react-dev-utils →
FAQ
The vulnerability allows for command injection on macOS systems, enabling attackers to execute arbitrary commands.
Versions up to and including 5.0.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.3, indicating a moderate severity level.
If you cannot update the package, avoid using the openBrowser function and ensure that any input is properly sanitized.
Related vulnerabilities
Recent vulnerabilities recorded for react-dev-utils.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
