{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-14620/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:webpack.js:webpack-dev-server:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":4.7,"id":"CVE-2026-14620"},{"cvss":5.3,"id":"CVE-2026-6402"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["webpack-dev-server (5.2.5)"],"_cs_severities":["high"],"_cs_tags":["webapps","csrf","cve-2026-14620"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eThe webpack-dev-server package, a widely used development tool for web applications, contains a CSRF vulnerability in versions 5.2.5 and below. The vulnerability exists within the /webpack-dev-server/open-editor endpoint, which is designed to open project files in a local editor. Research demonstrates that the security guard intended to prevent cross-origin access (implemented for CVE-2026-6402) is insufficient because it only restricts requests with specific headers (sec-fetch-mode: no-cors).\u003c/p\u003e\n\u003cp\u003eAn attacker can bypass this restriction using cross-site navigations (e.g., iframes, window.open) or fetch requests configured with mode: 'cors'. By invoking this endpoint from a malicious web page, an attacker can trigger the launchEditor() function on a developer's machine. This allows the attacker to force the execution of arbitrary existing files on the host filesystem, potentially leading to command execution depending on the configured editor environment. This issue was identified as CVE-2026-14620 and is tracked under GHSA-f5vj-f2hx-8m93.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker hosts a malicious website designed to execute cross-origin requests toward a victim's local developer environment.\u003c/li\u003e\n\u003cli\u003eThe victim, who is currently running a local instance of webpack-dev-server 5.2.5, navigates to the attacker-controlled website.\u003c/li\u003e\n\u003cli\u003eThe malicious website triggers an iframe or a fetch request with mode: 'cors' directed at the local development server on port 8080 (or the configured port).\u003c/li\u003e\n\u003cli\u003eThe request reaches the /webpack-dev-server/open-editor?fileName= endpoint on the local webpack-dev-server.\u003c/li\u003e\n\u003cli\u003eThe server fails to validate the origin of the 'navigate' or 'cors' request and passes the fileName parameter to the launchEditor() function.\u003c/li\u003e\n\u003cli\u003eThe launchEditor() function executes the local system's default editor (or the one defined in LAUNCH_EDITOR) using the attacker-supplied file path.\u003c/li\u003e\n\u003cli\u003eThe target file is opened in the local editor environment, which may result in arbitrary process execution if the editor is configured to interpret or run the targeted file.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to interact with the filesystem of a developer's workstation by proxying requests through the browser. This can lead to the unintended execution of local files or the exposure of sensitive source code and environment configuration, impacting the integrity of the development environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade webpack-dev-server to version 5.2.6 or later to apply the fix for CVE-2026-14620.\u003c/li\u003e\n\u003cli\u003eIn the absence of an immediate upgrade, restrict access to the development server by binding it to localhost and utilizing firewall rules to prevent inbound traffic from untrusted networks.\u003c/li\u003e\n\u003cli\u003eReview all custom editor launch configurations, as these environment variables may influence the severity of the code execution outcome.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-17T14:53:49Z","date_published":"2026-08-17T14:53:49Z","id":"https://feed.craftedsignal.io/briefs/2026-08-webpack-csrf/","summary":"A CSRF vulnerability (CVE-2026-14620) in webpack-dev-server 5.2.5 allows unauthenticated cross-origin requests to trigger the launchEditor() function, potentially enabling remote command execution via arbitrary local file paths.","title":"CSRF Vulnerability in webpack-dev-server","url":"https://feed.craftedsignal.io/briefs/2026-08-webpack-csrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-14620","version":"https://jsonfeed.org/version/1.1"}