CVSS 3.1
5.6 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:LCVE-2021-24033
Medium (5.6) in facebook react-dev-utils. EPSS 3.3% chance of exploitation in the next 30 days. Fixed in react-dev-utils 11.0.4.
react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. Only when this function is manually invoked with user-provided values (ie: by custom code) is there the potential for command injection. If you're consuming it from react-scripts then this issue does not affect you.
Severity
- EPSS
- 3.3% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
- CWE
- CWE-78
- Published
- Modified
- Record from
- the NVD, synced
Affected
- facebook:react-dev-utils
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-5q6m-3h65-w53x | npm | react-dev-utils | >=0.4.0 <11.0.4 | 11.0.4 |