Skip to content
Threat Feed
Subscribe

Product

React-Dev-Utils

1 brief RSS
high advisory

CVE-2026-14802: Remote OS Command Injection in React Create React App

A high-severity OS command injection vulnerability (CVE-2026-14802) exists in `react create-react-app` up to version 5.0.1, specifically within the `startBrowserProcess` function of the `openBrowser.js` file in the `react-dev-utils` component, allowing for remote exploitation and arbitrary OS command execution on affected macOS development environments.

create-react-app <= 5.0.1 +1 vulnerability command-injection macos web-application
2t 1c 6i