Cross-Origin State-Changing in webpack-dev-server

Executive Summary

The vulnerability in webpack-dev-server versions 5.2.5 and earlier involves two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, which perform state-changing actions on any GET request without verifying the request's origin.

This means that any website a developer visits while the dev server is running can trigger these endpoints cross-origin without any user interaction beyond visiting the site.

An attacker can exploit this to open arbitrary existing local files in the developer's editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer's machine.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to remotely trigger actions on your development machine without your consent.

• An attacker can open arbitrary local files in your editor, potentially exposing sensitive files indirectly.
• Repeated exploitation can spawn multiple editor processes and force recompilations, which can degrade your machine's performance.

While the vulnerability does not expose file contents directly, the ability to open files and degrade system performance can disrupt development workflows and potentially expose sensitive information through side channels.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects webpack-dev-server versions 5.2.5 and earlier, specifically exposing the internal endpoints /webpack-dev-server/open-editor and /webpack-dev-server/invalidate to cross-site request forgery (CSRF). To detect if your system is vulnerable, you can check the version of webpack-dev-server running on your machine.

• Run the command `npm list webpack-dev-server` or `yarn list webpack-dev-server` in your project directory to identify the installed version.
• Monitor network traffic for GET requests to the endpoints `/webpack-dev-server/open-editor` and `/webpack-dev-server/invalidate` coming from unexpected origins.
• Use tools like curl or wget to test if these endpoints respond to GET requests without origin verification, for example: `curl -v http://localhost:<port>/webpack-dev-server/open-editor`.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade webpack-dev-server to version 5.2.6 or later, where the vulnerability has been patched by rejecting cross-site requests to the vulnerable endpoints.

There are no known workarounds other than upgrading.

Until you upgrade, avoid running webpack-dev-server in environments where untrusted websites can be visited simultaneously, as any website visited can trigger the vulnerable endpoints.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of the CVE-2026-14620 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0