cve.bz

CVE-2026-14802

5.5 mediumEPSS 2.1%

Medium (5.5). EPSS 2.1% chance of exploitation in the next 30 days.

A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProcess of the file openBrowser.js of the component react-dev-utils. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Severity

CVSS 4.0

5.5 medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

7.3 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS
2.1% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
CWEs
CWE-77, CWE-78
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-g9g6-gvq9-j4vpnpmreact-dev-utils<=5.0.1no fix published

References

Check your stackJSON