CVE-2026-14802: react create-react-app react-dev-utils openBrowser.js startBrowserProcess os command injection

Q: What is the severity of CVE-2026-14802?

The severity of CVE-2026-14802 is rated as high with a score of 7.3.

Q: How do I fix CVE-2026-14802?

To fix CVE-2026-14802, upgrade react-dev-utils to version 5.0.2 or later.

Q: What systems are affected by CVE-2026-14802?

CVE-2026-14802 affects react create-react-app versions up to 5.0.1 on macOS.

Q: What type of vulnerability is CVE-2026-14802?

CVE-2026-14802 is categorized as an OS Command Injection vulnerability.

Q: Can CVE-2026-14802 be exploited remotely?

Yes, CVE-2026-14802 can be exploited remotely.

Published Jul 6, 2026

Updated

A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProcess of the file openBrowser.js of the component react-dev-utils. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected Software

2 affected components

npm/react-dev-utils/openBrowser.js<=5.0.1

npm/react-dev-utils<=5.0.1

Event History

Jul 6, 2026

CVE Published

via MITRE·06:30 AM

Data Sourced

via MITRE·06:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-14802?

The severity of CVE-2026-14802 is rated as high with a score of 7.3.

How do I fix CVE-2026-14802?

To fix CVE-2026-14802, upgrade react-dev-utils to version 5.0.2 or later.

What systems are affected by CVE-2026-14802?