Cve-2026-14620 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-14620/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 17 Aug 2026 14:53:49 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCSRF Vulnerability in webpack-dev-serverhttps://feed.craftedsignal.io/briefs/2026-08-webpack-csrf/Mon, 17 Aug 2026 14:53:49 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-webpack-csrf/A CSRF vulnerability (CVE-2026-14620) in webpack-dev-server 5.2.5 allows unauthenticated cross-origin requests to trigger the launchEditor() function, potentially enabling remote command execution via arbitrary local file paths.The webpack-dev-server package, a widely used development tool for web applications, contains a CSRF vulnerability in versions 5.2.5 and below. The vulnerability exists within the /webpack-dev-server/open-editor endpoint, which is designed to open project files in a local editor. Research demonstrates that the security guard intended to prevent cross-origin access (implemented for CVE-2026-6402) is insufficient because it only restricts requests with specific headers (sec-fetch-mode: no-cors).

An attacker can bypass this restriction using cross-site navigations (e.g., iframes, window.open) or fetch requests configured with mode: 'cors'. By invoking this endpoint from a malicious web page, an attacker can trigger the launchEditor() function on a developer's machine. This allows the attacker to force the execution of arbitrary existing files on the host filesystem, potentially leading to command execution depending on the configured editor environment. This issue was identified as CVE-2026-14620 and is tracked under GHSA-f5vj-f2hx-8m93.

Attack Chain

  1. Attacker hosts a malicious website designed to execute cross-origin requests toward a victim's local developer environment.
  2. The victim, who is currently running a local instance of webpack-dev-server 5.2.5, navigates to the attacker-controlled website.
  3. The malicious website triggers an iframe or a fetch request with mode: 'cors' directed at the local development server on port 8080 (or the configured port).
  4. The request reaches the /webpack-dev-server/open-editor?fileName= endpoint on the local webpack-dev-server.
  5. The server fails to validate the origin of the 'navigate' or 'cors' request and passes the fileName parameter to the launchEditor() function.
  6. The launchEditor() function executes the local system's default editor (or the one defined in LAUNCH_EDITOR) using the attacker-supplied file path.
  7. The target file is opened in the local editor environment, which may result in arbitrary process execution if the editor is configured to interpret or run the targeted file.

Impact

Successful exploitation allows an attacker to interact with the filesystem of a developer's workstation by proxying requests through the browser. This can lead to the unintended execution of local files or the exposure of sensitive source code and environment configuration, impacting the integrity of the development environment.

Recommendation

  • Upgrade webpack-dev-server to version 5.2.6 or later to apply the fix for CVE-2026-14620.
  • In the absence of an immediate upgrade, restrict access to the development server by binding it to localhost and utilizing firewall rules to prevent inbound traffic from untrusted networks.
  • Review all custom editor launch configurations, as these environment variables may influence the severity of the code execution outcome.
]]>highthreatwebappscsrfcve-2026-14620