CVE-2023-5654: Medium severity react developer tools vulnerability
The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received message via fetch(). The URL is not validated or sanitised before it is fetched, thus allowing a malicious web page to arbitrarily fetch URL’s via the victim's browser.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-5654?
CVE-2023-5654 is a vulnerability in the React Developer Tools extension that allows an attacker to execute arbitrary code on a user's machine.
How does CVE-2023-5654 affect my system?
CVE-2023-5654 affects systems where the React Developer Tools extension version 4.28.4 or earlier is installed.
What is the severity of CVE-2023-5654?
CVE-2023-5654 has a severity rating of 6.5, which is considered medium.
How can I fix CVE-2023-5654?
To fix CVE-2023-5654, update the React Developer Tools extension to version 4.28.4 or later.
Where can I find more information about CVE-2023-5654?
More information about CVE-2023-5654 can be found at the following references: [Link to GitHub Gist](https://gist.github.com/CalumHutton/1fb89b64409570a43f89d1fd3274b231), [Link to NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-5654), [Link to GitHub Pull Request](https://github.com/facebook/react/pull/27417).