CVE-2021-24033: react-dev-utils OS Command Injection in function `getProcessForPort`
Summary
CVE-2021-24033: react-dev-utils OS Command Injection in function getProcessForPort. Affects react-dev-utils versions >= 0.4.0, < 11.0.4. Fixed in 11.0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
react-dev-utils is an npm package that provides various utilities for development with React. It includes functions and tools that assist in tasks such as starting a development server, creating optimized builds, and managing environment variables. The package is commonly used in Create React App projects, where it is integrated with react-scripts. However, it also exposes functions that can be used independently. One such function is getProcessForPort, which is vulnerable to OS command injection.
Vulnerability Detail
The vulnerability in react-dev-utils prior to v11.0.4 lies in the getProcessForPort function. This function takes an input argument and concatenates it into a command string that is executed. While the usage of this function within react-scripts is safe, manual invocation with user-provided values can lead to command injection. Attackers can exploit this vulnerability by providing malicious input that gets executed as part of the command, potentially allowing them to execute arbitrary commands on the host system. It is important to note that if you are consuming react-dev-utils through react-scripts, you are not affected by this vulnerability.
How To Fix
Latest published version: 12.0.1 as of 23 Oct 2026
npm install react-dev-utils@12.0.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.0.4
This is the first release that contains the fix.
npm install react-dev-utils@11.0.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating react-dev-utils is not immediately feasible, a possible workaround is to avoid manually invoking the getProcessForPort function with user-provided values. Instead, rely on the usage of react-scripts, which handles the function safely. By using react-scripts, you can mitigate the risk of command injection.
Conclusion
In conclusion, the react-dev-utils package prior to v11.0.4 is vulnerable to OS command injection in the getProcessForPort function. This vulnerability can be mitigated by updating to the latest version of the package. If immediate update is not possible, avoid manually invoking the vulnerable function with user-provided values. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for react-dev-utils →
FAQ
react-dev-utils is an npm package that provides utilities for development with React. It includes functions and tools for tasks such as starting a development server and creating optimized builds.
The vulnerable function is getProcessForPort, which is used to retrieve information about the process running on a specific port. It is susceptible to OS command injection when manually invoked with user-provided values.
Attackers can exploit the vulnerability by providing malicious input that gets executed as part of the command in the getProcessForPort function. This can allow them to execute arbitrary commands on the host system.
If you are consuming react-dev-utils through react-scripts, you are not affected by this vulnerability. The vulnerability only arises when the getProcessForPort function is manually invoked with user-provided values.
To fix this vulnerability, update react-dev-utils to version 11.0.4 or later. This version includes a fix for the command injection vulnerability in the getProcessForPort function.
References
Related vulnerabilities
Recent vulnerabilities recorded for react-dev-utils.
