Command Injection in React Create React App

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

The CVE-2026-14802 vulnerability is an OS command injection flaw found in the startBrowserProcess function of the openBrowser.js file within the react-dev-utils package used by react create-react-app. The issue arises because URLs passed to this function are improperly sanitized using encodeURI, which does not escape shell-significant characters such as $, (, and ). When these URLs are executed in a shell command, the shell expands command substitutions, allowing an attacker to execute arbitrary commands on the system.

This vulnerability allows remote exploitation by controlling the URL passed to the openBrowser function, potentially leading to remote code execution on a developer's workstation. A proof of concept demonstrates this by injecting a payload that creates a file on the system, confirming the ability to run arbitrary commands.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts, especially for developers using react create-react-app on macOS. An attacker who can influence the URL passed to the vulnerable function can execute arbitrary commands on the developer's machine remotely.

• Remote Code Execution (RCE) on the developer's workstation.
• Potential compromise of development environments, including access to sensitive files or credentials.
• Execution of malicious commands that could alter or damage the system.
• Risk to millions of developers if malicious URLs are introduced via .env files, middleware, or shared development environments.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for the presence of the vulnerable version of the react-dev-utils package, specifically version 12.0.1, which contains the OS command injection flaw in the startBrowserProcess function of openBrowser.js.

A practical detection method is to look for evidence of exploitation attempts by searching for files created by the Proof of Concept (PoC) payload, such as the file /tmp/RCE_VERIFIED, which indicates that the command injection was successful.

You can use the following command on macOS or Linux systems to check if the PoC file exists, which would confirm exploitation:

• ls -l /tmp/RCE_VERIFIED

Additionally, you can search your project dependencies to identify if react-dev-utils version 12.0.1 is installed by running:

• npm ls react-dev-utils

Monitoring shell command executions triggered by URLs containing shell-significant characters like $, (, and ) in development environments may also help detect attempts to exploit this vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include avoiding the use of the vulnerable react-dev-utils version 12.0.1 and any create-react-app versions up to 5.0.1 on macOS.

Since the project has not yet responded with a patch, you should consider the following actions:

• Remove or restrict any untrusted input that could be passed as URLs to the openBrowser function to prevent command injection.
• Avoid opening URLs from untrusted sources in development environments using create-react-app.
• Monitor and audit your development environment for suspicious files or processes that could indicate exploitation.
• Consider migrating to alternative React frameworks or tools that do not rely on the vulnerable package, as recommended by the community.

Useful 0 Not Useful 0