Vulnerability GHSA-5q6m-3h65-w53x
Medium Risk
MEDIUM RISK
CVSS Score: 5.6
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
5 years ago
March 11, 2021 at 10:26 PM UTC
react-dev-utils OS Command Injection in function `getProcessForPort`
0.4.0 - 11.0.3
0.4.0 - 11.0.3
Summary
react-dev-utils OS Command Injection in function `getProcessForPort`
Details
react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. Only when this function is manually invoked with user-provided values (ie: by custom code) is there the potential for command injection. If you're consuming it from react-scripts then this issue does not affect you.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
2 months ago
react-dev-utils openBrowser permits command injection on macOS
0.0.0 - 5.0.1 GHSA-g9g6-gvq9-j4vp
0.0.0 - 5.0.1 GHSA-g9g6-gvq9-j4vp
High Risk
7 years ago
react-dev-utils on Windows vulnerable to Remote Code Execution
1.0.0 - 1.0.3 and 2.0.0 - 2.0.1 and 3.0.0 - 3.1.1 and 4.0.0 - 4.2.1 and 5.0.0 - 5.0.1 GHSA-29gp-92wp-94q8
1.0.0 - 1.0.3 and 2.0.0 - 2.0.1 and 3.0.0 - 3.1.1 and 4.0.0 - 4.2.1 and 5.0.0 - 5.0.1 GHSA-29gp-92wp-94q8
Impacted packages
Timeline
Published
5 years ago
March 11, 2021 at 10:26 PM UTC
Fixed (11.0.4)
Unknown
Unknown
Last Modified
2 years ago
November 08, 2023 at 04:05 AM UTC