Critical
Security advisory
react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editor. The input to that command was not properly sanitized, allowing an attacker who can make a network request to the server (either via CSRF or by direct request) to execute arbitrary commands on the targeted system. This issue affects multiple branches: 1.x.x prior to 1.0.4, 2.x.x prior to 2.0.2, 3.x.x prior to 3.1.2, 4.x.x prior to 4.2.2, and 5.x.x prior to 5.0.2.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2018-6342
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 10:10 UTC · Revision 1
Source evidence
react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editor. The input to that command was not properly sanitized, allowing an attacker who can make a network request to the server (either via CSRF or by direct request) to execute arbitrary commands on the targeted system. This issue affects multiple branches: 1.x.x prior to 1.0.4, 2.x.x prior to 2.0.2, 3.x.x prior to 3.1.2, 4.x.x prior to 4.2.2, and 5.x.x prior to 5.0.2.
osv:CVE-2018-6342
Complete source record
{
"id": "f59b700334200801efa49b076357fb34dba56889a6a857910ed50a78390a03bb",
"url": "https://osv.dev/vulnerability/CVE-2018-6342",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2018-6342",
"summary": "react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editor. The input to that command was not properly sanitized, allowing an attacker who can make a network request to the server (either via CSRF or by direct request) to execute arbitrary commands on the targeted system. This issue affects multiple branches: 1.x.x prior to 1.0.4, 2.x.x prior to 2.0.2, 3.x.x prior to 3.1.2, 4.x.x prior to 4.2.2, and 5.x.x prior to 5.0.2.",
"evidence": "osv:CVE-2018-6342",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2018-6342",
"aliases": [
"CVE-2018-6342",
"GHSA-29gp-92wp-94q8"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/react/create-react-app",
"type": "GIT",
"events": [
{
"introduced": "bf9eca25f519c73f69cff20ac49ce9500e578fe0"
},
{
"fixed": "7e25c9a6046fe057d3b4cc2eae20a0661d0273f3"
},
{
"introduced": "ac5376f9b9ef589961f0231608395cbc4d903ba1"
},
{
"fixed": "f0784fc27f538935efe4080033f49bf7c89577f2"
},
{
"introduced": "265c1592dcf3853122dcdd50e1bfc1e43f697fbe"
},
{
"fixed": "a825e8f5e3b7ecd84a0bcef61bbc26eb4e8fd9c3"
},
{
"introduced": "9673858a3715287c40aef9e800c431c7d45c05a2"
},
{
"fixed": "f0784fc27f538935efe4080033f49bf7c89577f2"
},
{
"fixed": "dc74990b89b5c6e143b522c759be3dac2c286514"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:facebook:react-dev-utils:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.0.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:facebook:react-dev-utils:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:facebook:react-dev-utils:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.1.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:facebook:react-dev-utils:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.0.2"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "dc74990b89b5c6e143b522c759be3dac2c286514"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v1.1.5"
}
]
}
}
],
"versions": [
"v3.1.1",
"react-scripts@3.1.1",
"react-error-overlay@6.0.1",
"react-dev-utils@9.0.3",
"eslint-config-react-app@5.0.1",
"create-react-app@3.1.1",
"v3.1.0",
"react-scripts@3.1.0",
"react-error-overlay@6.0.0",
"react-dev-utils@9.0.2",
"react-app-polyfill@1.0.2",
"eslint-config-react-app@5.0.0",
"create-react-app@3.1.0",
"confusing-browser-globals@1.0.8",
"babel-preset-react-app@9.0.1",
"babel-plugin-named-asset-import@0.3.3",
"v3.0.1",
"react-scripts@3.0.1",
"react-error-overlay@5.1.6",
"react-dev-utils@9.0.1",
"react-app-polyfill@1.0.1",
"eslint-config-react-app@4.0.1",
"create-react-app@3.0.1",
"babel-preset-react-app@9.0.0",
"v3.0.0",
"react-scripts@3.0.0",
"react-error-overlay@5.1.5",
"react-dev-utils@9.0.0",
"react-app-polyfill@1.0.0",
"eslint-config-react-app@4.0.0",
"create-react-app@3.0.0",
"confusing-browser-globals@1.0.7",
"babel-preset-react-app@8.0.0",
"babel-plugin-named-asset-import@0.3.2",
"react-scripts@2.0.1",
"react-error-overlay@5.0.1",
"react-dev-utils@6.0.1",
"react-app-polyfill@0.1.1",
"babel-preset-react-app@5.0.0",
"react-scripts@2.0.0",
"v1.0.3",
"react-scripts@1.0.3",
"react-error-overlay@1.0.3",
"react-dev-utils@1.0.3",
"eslint-config-react-app@1.0.2",
"v1.0.2",
"react-scripts@1.0.2",
"react-error-overlay@1.0.2",
"react-dev-utils@1.0.2",
"v1.0.1",
"react-scripts@1.0.1",
"react-error-overlay@1.0.1",
"react-dev-utils@1.0.1",
"eslint-config-react-app@1.0.1",
"v1.0.0",
"react-scripts@1.0.0",
"react-error-overlay@1.0.0",
"react-dev-utils@1.0.0",
"eslint-config-react-app@1.0.0",
"create-react-app@1.3.1",
"babel-preset-react-app@3.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-6342.json"
}
}
],
"modified": "2026-10-20T10:49:55.903615423Z",
"provider": "osv",
"references": [
"https://github.com/facebook/create-react-app/pull/4866",
"https://github.com/facebook/create-react-app/releases/tag/v1.1.5"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:facebook:react-dev-utils:*:*:*:*:*:*:*:*"
],
"vendor_product": "facebook:react-dev-utils",
"extracted_events": [
{
"range": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.2.2"
}
],
"source": "CPE_RANGE"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2018-6342",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 380994,
"published_at": "2018-12-31T22:29:00.467+00:00"
}