Skip to content
Threat Feed
Subscribe

Product

Webpack-Dev-Server (5.2.5)

1 brief RSS
high threat

CSRF Vulnerability in webpack-dev-server

A CSRF vulnerability (CVE-2026-14620) in webpack-dev-server 5.2.5 allows unauthenticated cross-origin requests to trigger the launchEditor() function, potentially enabling remote command execution via arbitrary local file paths.

exploited webpack-dev-server webapps csrf cve-2026-14620
1r 1t 2c