CVE-2026-97366: jhen0409 react-native-debugger Open in Editor window.js openDevTools os command injection
A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of the file electron/window.js of the component Open in Editor Handler. The manipulation of the argument host results in os command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
The affected product is jhen0409 react-native-debugger, with versions up to and including 0.14.0 identified as vulnerable. The issue is in the Open in Editor Handler's openDevTools function in electron/window.js.
What does an attacker need to exploit this issue?
The attack manipulates the host argument passed to openDevTools, resulting in OS command injection. It can be launched remotely and requires user interaction, but no attacker privileges are required.
Is public exploit code available?
Yes. The exploit has been publicly released and may be used in attacks.
Is a vendor fix or workaround available?
No vendor response or remediation is described. The vendor was contacted early about the disclosure but did not respond.