CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LCVE-2023-5654
Medium (6.5) in facebook react-devtools. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in react-devtools-core 4.28.4.
The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received message via fetch(). The URL is not validated or sanitised before it is fetched, thus allowing a malicious web page to arbitrarily fetch URL’s via the victim's browser.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-285, CWE-116
- Published
- Modified
- Record from
- the NVD, synced
Affected
- facebook:react-devtools
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-rxrc-rgv4-jpvx | npm | react-devtools-core | <4.28.4 | 4.28.4 |