Search for packages
| purl | pkg:npm/react-dev-utils@3.0.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-157d-619z-sue1
Aliases: CVE-2021-24033 GHSA-5q6m-3h65-w53x |
Affected by 0 other vulnerabilities. |
|
|
VCID-dqc7-k8r4-pyej
Aliases: CVE-2018-6342 GHSA-29gp-92wp-94q8 |
react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editor. The input to that command was not properly sanitized, allowing an attacker who can make a network request to the server (either via CSRF or by direct request) to execute arbitrary commands on the targeted system. This issue affects multiple branches: 1.x.x prior to 1.0.4, 2.x.x prior to 2.0.2, 3.x.x prior to 3.1.2, 4.x.x prior to 4.2.2, and 5.x.x prior to 5.0.2. |
Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-12T17:34:23.433106+00:00 | GitLab Importer | Affected by | VCID-157d-619z-sue1 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/react-dev-utils/CVE-2021-24033.yml | 38.6.0 |
| 2026-06-12T15:41:21.740144+00:00 | GitLab Importer | Affected by | VCID-dqc7-k8r4-pyej | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/react-dev-utils/CVE-2018-6342.yml | 38.6.0 |
| 2026-06-11T20:24:53.888007+00:00 | GHSA Importer | Affected by | VCID-dqc7-k8r4-pyej | https://github.com/advisories/GHSA-29gp-92wp-94q8 | 38.6.0 |