org.webjars.npm:react-dev-utils 4.0.1 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.webjars.npm:react-dev-utils package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability	Vulnerable Version
M Command Injection org.webjars.npm:react-dev-utils is an includes some utilities used by Create React App. Affected versions of this package are vulnerable to Command Injection via `getProcessForPort` - where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. Only when this function is manually invoked with user-provided values (ie: by custom code) is there the potential for command injection. If you're consuming it from react-scripts then this issue does not affect you. How to fix Command Injection? There is no fixed version for `org.webjars.npm:react-dev-utils`.	[0,)
H Arbitrary Code Execution org.webjars.npm:react-dev-utils includes some utilities used by Create React App. Affected versions of this package are vulnerable to Arbitrary Code Execution. On Windows, developers are allowed to run a local webserver for accepting various commands, including a command to launch an editor. The input to that command was not properly sanitized, allowing an attacker who can make a network request to the server (either via CSRF or by direct request) to execute arbitrary commands on the targeted system. How to fix Arbitrary Code Execution? Upgrade `org.webjars.npm:react-dev-utils` to version 1.0.4, 2.0.2, 3.1.2, 4.2.2, 5.0.2 or higher.	[1.0.0,1.0.4)[2.0.0,2.0.2)[3.0.0,3.1.2)[4.0.0,4.2.2)[5.0.0,5.0.2)

Vulnerability

Vulnerable Version

Command Injection

org.webjars.npm:react-dev-utils is an includes some utilities used by Create React App.

Affected versions of this package are vulnerable to Command Injection via getProcessForPort - where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. Only when this function is manually invoked with user-provided values (ie: by custom code) is there the potential for command injection. If you're consuming it from react-scripts then this issue does not affect you.

How to fix Command Injection?

There is no fixed version for org.webjars.npm:react-dev-utils.

[0,)

Arbitrary Code Execution

org.webjars.npm:react-dev-utils includes some utilities used by Create React App.

Affected versions of this package are vulnerable to Arbitrary Code Execution. On Windows, developers are allowed to run a local webserver for accepting various commands, including a command to launch an editor. The input to that command was not properly sanitized, allowing an attacker who can make a network request to the server (either via CSRF or by direct request) to execute arbitrary commands on the targeted system.

How to fix Arbitrary Code Execution?

Upgrade org.webjars.npm:react-dev-utils to version 1.0.4, 2.0.2, 3.1.2, 4.2.2, 5.0.2 or higher.

[1.0.0,1.0.4)[2.0.0,2.0.2)[3.0.0,3.1.2)[4.0.0,4.2.2)[5.0.0,5.0.2)

org.webjars.npm:react-dev-utils@4.0.1 vulnerabilities

latest version

first published

latest version published

licenses detected

package manager

Direct Vulnerabilities

How to fix?