CVE-2023-5654
First published: Thu Oct 19 2023(Updated: )
The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received message via fetch(). The URL is not validated or sanitised before it is fetched, thus allowing a malicious web page to arbitrarily fetch URL’s via the victim's browser.
Credit: report@snyk.io report@snyk.io report@snyk.io
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/react-devtools-core | <4.28.4 | 4.28.4 |
| Facebook React-devtools | <4.28.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2023-5654
- https://gist.github.com/CalumHutton/1fb89b64409570a43f89d1fd3274b231
- https://github.com/facebook/react/pull/27417
- https://github.com/facebook/react/commit/09285d5a7f1c08bec09f44cec3d0518a603597fc
- https://github.com/facebook/react/commit/94d5b5b2bf5204ebd289a113989c0e2c51b626ef
- https://github.com/advisories/GHSA-rxrc-rgv4-jpvx (Advisory)
Frequently Asked Questions
What is CVE-2023-5654?
CVE-2023-5654 is a vulnerability in the React Developer Tools extension that allows an attacker to execute arbitrary code on a user's machine.
How does CVE-2023-5654 affect my system?
CVE-2023-5654 affects systems where the React Developer Tools extension version 4.28.4 or earlier is installed.
What is the severity of CVE-2023-5654?
CVE-2023-5654 has a severity rating of 6.5, which is considered medium.
How can I fix CVE-2023-5654?
To fix CVE-2023-5654, update the React Developer Tools extension to version 4.28.4 or later.
Where can I find more information about CVE-2023-5654?
More information about CVE-2023-5654 can be found at the following references: [Link to GitHub Gist](https://gist.github.com/CalumHutton/1fb89b64409570a43f89d1fd3274b231), [Link to NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-5654), [Link to GitHub Pull Request](https://github.com/facebook/react/pull/27417).
- collector/nvd-api
- collector/nvd-cve
- collector/nvd-index
- collector/github-advisory
- alias/GHSA-rxrc-rgv4-jpvx
- alias/CVE-2023-5654
- collector/github-advisory-latest
- agent/author
- agent/description
- agent/epss
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/epss-latest
- source/FIRST
- vendor/facebook
- canonical/facebook react-devtools
- package-manager/npm