CVE-2018-6342

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editor. The input to that command was not properly sanitized, allowing an attacker who can make a network request to the server (either via CSRF or by direct request) to execute arbitrary commands on the targeted system. This issue affects multiple branches: 1.x.x prior to 1.0.4, 2.x.x prior to 2.0.2, 3.x.x prior to 3.1.2, 4.x.x prior to 4.2.2, and 5.x.x prior to 5.0.2.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
Facebookreact-dev-utils5.0.2; >= 5.0.0, < unspecified; 4.2.2; >= 4.0.0, < unspecified; 3.1.2; >= 3.0.0, < unspecified; 2.0.2; >= 2.0.0, < unspecified; 1.0.4; >= 1.0.0, < unspecified

References

Timeline

Published
Dec 31, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-63437.5Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsiCVE-2018-63447.5A heap corruption in WhatsApp can be caused by a malformed RTP packet being sent after a call is established. The vulnerability can be used CVE-2018-63459.8The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively large. The internal CVE-2018-63467.5A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings (specifically a circular dependency). This aCVE-2018-63477.5An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack. This affects Proxygen prior tCVE-2018-63499.8When receiving calls using WhatsApp for Android, a missing size check when parsing a sender-provided packet allowed for a stack-based overflCVE-2018-63509.8An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers. This issue affects WhatsApp for Android prCVE-2018-63525.5In PoDoFo 0.9.5, there is an Excessive Iteration in the PdfParser::ReadObjectsInternal function of base/PdfParser.cpp. Remote attackers coulCVE-2018-63537.8The Python console in Electrum through 2.9.4 and 3.x through 3.0.5 supports arbitrary Python code without considering (1) social-engineeringCVE-2018-63546.1templates/forms/thanks.html in Formspree before 2018-01-23 allows XSS related to the _next parameter.CVE-2018-63556.1/goform/setLang on iBall 300M devices with "iB-WRB302N_1.0.1-Sep 8 2017" firmware has Unauthenticated Stored Cross Site Scripting via the laCVE-2018-63566.5Jenkins before 2.107 and Jenkins LTS before 2.89.4 did not properly prevent specifying relative paths that escape a base directory for URLs