{"id":"CVE-2018-6342","aliases":["GHSA-29gp-92wp-94q8"],"url":"https://o3.security/vulnerability/CVE-2018-6342","summary":"react-dev-utils on Windows vulnerable to Remote Code Execution","details":"react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editor. The input to that command was not properly sanitized, allowing an attacker who can make a network request to the server (either via CSRF or by direct request) to execute arbitrary commands on the targeted system. This issue affects multiple branches: 1.x.x prior to 1.0.4, 2.x.x prior to 2.0.2, 3.x.x prior to 3.1.2, 4.x.x prior to 4.2.2, and 5.x.x prior to 5.0.2.","published":"2018-12-31T22:29:00.467Z","modified":"2026-08-27T03:47:43.458711934Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"react-dev-utils","fixedVersion":"1.0.4"},{"ecosystem":"npm","name":"react-dev-utils","fixedVersion":"2.0.2"},{"ecosystem":"npm","name":"react-dev-utils","fixedVersion":"3.1.2"},{"ecosystem":"npm","name":"react-dev-utils","fixedVersion":"4.2.2"},{"ecosystem":"npm","name":"react-dev-utils","fixedVersion":"5.0.2"}],"fix":{"url":"https://github.com/facebook/create-react-app/pull/4866","label":"facebook/create-react-app#4866"},"references":[{"type":"ADVISORY","url":"https://github.com/facebook/create-react-app/pull/4866"},{"type":"ADVISORY","url":"https://github.com/facebook/create-react-app/releases/tag/v1.1.5"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-27T03:47:43.458711934Z"}}