CVE-2026-14802
HighCVSS 7.3Exploitation Probability (EPSS)
Elevated risk67th percentile - higher than 67% of all known CVEs
Summary
A vulnerability was found in create-react-app up to version 5.0.1 on macOS. The startBrowserProcess function in openBrowser.js of the react-dev-utils component allows OS command injection. Remote exploitation is possible and the exploit is publicly available.
Risk Assessment
The organization is at risk of remote arbitrary command execution on macOS development machines, potentially leading to system compromise, data theft, or lateral movement within the development environment.
Recommendation
Immediately update create-react-app to the latest available version or switch to an alternative tool if no patch is provided. Until then, avoid using the tool on macOS and monitor for public exploits.
Original NVD description (English source)
A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProcess of the file openBrowser.js of the component react-dev-utils. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.