Remote Command Injection in React Native Debugger

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: VulDB

Description

A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of the file electron/window.js of the component Open in Editor Handler. The manipulation of the argument host results in os command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-24

Generated

2026-09-25

AI Q&A

2026-09-25

EPSS Evaluated

N/A

NVD

CVE-2026-97366

Affected Vendors & Products

Vendor	Product	Version / Range
jhen0409	react-native-debugger	to 0.14.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is an OS command injection flaw in jhen0409 react-native-debugger up to version 0.14.0. It exists in the openDevTools function of the electron/window.js file, specifically in the Open in Editor Handler component. The issue arises when the host argument is manipulated, allowing attackers to inject and execute arbitrary operating system commands remotely.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary OS commands on your system if you are using a vulnerable version of react-native-debugger. This could lead to unauthorized access, data theft, installation of malware, or disruption of services. The exploit is publicly available, increasing the risk of attacks.

Mitigation Strategies

Immediately upgrade jhen0409 react-native-debugger to a version beyond 0.14.0 if available. If no patched version exists, consider discontinuing use of the software until a fix is released. Monitor vendor communications for updates.

Hi! I’m here to help you understand CVE-2026-97366. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70