GitHub Advisoryadvisory · npm

GHSA-29gp-92wp-94q8 react-dev-utils on Windows vulnerable to Remote Code Execution

HIGH Published 2019-01-04 Modified 2022-08-03 Official page ↗
Aliases
CVE-2018-6342
Ecosystem
npm
Packages
react-dev-utils
Severity
High
Weaknesses
CWE-78
Reviewed
2020-06-16

Affected packages

• npm react-dev-utils: >= 1.0.0, < 1.0.4 → fixed in 1.0.4 • npm react-dev-utils: >= 2.0.0, < 2.0.2 → fixed in 2.0.2 • npm react-dev-utils: >= 3.0.0, < 3.1.2 → fixed in 3.1.2 • npm react-dev-utils: >= 4.0.0, < 4.2.2 → fixed in 4.2.2 • npm react-dev-utils: >= 5.0.0, < 5.0.2 → fixed in 5.0.2

Description

`react-dev-utils` on Windows is vulnerable to remote code execution. Recommendation Update to one of the following versions, depending on the release line that you are using. • 1.0.4 • 2.0.2 • 3.1.2 • 4.2.2 • 5.0.2 • 6.0.0-next.a671462c

Related

Alias · CVE (1)

  • CVE-2018-6342 react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References