CVE-2018-6342: react-dev-utils on Windows vulnerable to Remote Code Execution
Summary
CVE-2018-6342: react-dev-utils on Windows vulnerable to Remote Code Execution. Affects react-dev-utils across 5 version ranges.
>= 1.0.0, < 1.0.4
>= 2.0.0, < 2.0.2
>= 3.0.0, < 3.1.2
>= 4.0.0, < 4.2.2
>= 5.0.0, < 5.0.2
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
react-dev-utils is an open-source package in the npm ecosystem. It provides various utilities for development with React. This package is widely used by developers to enhance their React development workflow. However, versions of react-dev-utils running on Windows are vulnerable to remote code execution.
Vulnerability Detail
The vulnerability in react-dev-utils on Windows allows an attacker to execute arbitrary code remotely. This can lead to unauthorized access, data breaches, and potential compromise of the affected system. The vulnerability is classified as CWE-78, which is the Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') weakness.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.0.41.0.4npm install react-dev-utils@1.0.4 -
>= 2.0.0, < 2.0.22.0.2npm install react-dev-utils@2.0.2 -
>= 3.0.0, < 3.1.23.1.2npm install react-dev-utils@3.1.2 -
>= 4.0.0, < 4.2.24.2.2npm install react-dev-utils@4.2.2 -
>= 5.0.0, < 5.0.25.0.2npm install react-dev-utils@5.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is crucial to update the package to the fixed versions as soon as possible to mitigate the risk of remote code execution.
Conclusion
In conclusion, react-dev-utils on Windows is vulnerable to remote code execution. It is crucial to update the package to the fixed versions mentioned above to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for react-dev-utils →
FAQ
react-dev-utils is an npm package that provides utilities for development with React. It includes various tools and configurations to enhance the React development workflow.
The vulnerability allows an attacker to execute arbitrary code remotely on systems running react-dev-utils on Windows. This can lead to unauthorized access, data breaches, and potential compromise of the affected system.
This vulnerability is classified as CWE-78, which is the Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') weakness.
To fix this vulnerability, update react-dev-utils to one of the fixed versions: 1.0.4, 2.0.2, 3.1.2, 4.2.2, 5.0.2, or 6.0.0-next.a671462c.
There is no specific workaround mentioned for this vulnerability. It is recommended to update the package to the fixed versions as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for react-dev-utils.
