CVE-2026-14620

About vulnerability

Impact

The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server’s own page. Any website a developer visits while the dev server is running can trigger them cross-origin with no interaction beyond the visit.

An attacker can open an arbitrary existing local file in the developer’s editor, including files outside the project root (e.g. ~/.ssh/config). The file’s contents are not returned to the attacker. Repeated requests can also spawn editor processes and force recompilations, degrading the developer’s machine.

Patches

Fixed in webpack-dev-server 5.2.6 by rejecting cross-site requests to the /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints (see [PR #5698](https://github.com/webpack/webpack-dev-server/pull/5698)).

Workarounds

None

Affected product:

AngularJS , React , Vue , create-react-app , docusaurus , docusaurus-core , docusaurus-plugin-content-blog , docusaurus-plugin-content-docs , docusaurus-plugin-content-pages , docusaurus-plugin-debug , docusaurus-plugin-google-analytics , docusaurus-plugin-google-gtag , docusaurus-plugin-google-tag-manager , docusaurus-plugin-sitemap , docusaurus-preset-classic , docusaurus-theme-classic , docusaurus-theme-common , docusaurus-theme-mermaid , docusaurus-theme-search-algolia , electron-webpack , expo , expo-cli , expo-dev-tools , expo-electron-adapter , expo-image , expo-linking , expo-modules-core , expo-prebuild-config , expo-screen-capture , expo-standard-web-crypto , expo-status-bar , expo-symbols , expo-webpack-config , expo-yarn-workspaces , gatsby , gatsby-cypress , gatsby-interface , gatsby-plugin-compile-es6-packages , gatsby-plugin-emotion , gatsby-plugin-fathom , gatsby-plugin-feed , gatsby-plugin-google-gtag , gatsby-plugin-guess-js , gatsby-plugin-less , gatsby-plugin-manifest , gatsby-plugin-netlify , gatsby-plugin-no-sourcemaps , gatsby-plugin-offline , gatsby-plugin-postcss , gatsby-plugin-preact , gatsby-plugin-preload-fonts , gatsby-plugin-react-helmet , gatsby-plugin-schema-snapshot , gatsby-plugin-sitemap , gatsby-plugin-styletron , gatsby-plugin-typography , gatsby-react-router-scroll , gatsby-remark-code-repls , gatsby-remark-embed-snippet , gatsby-remark-prismjs , gatsby-remark-responsive-iframe , gatsby-source-contentful , gatsby-source-drupal , gatsby-source-filesystem , gatsby-source-graphql , gatsby-source-shopify , gatsby-source-wordpress , gatsby-transformer-react-docgen , gatsby-transformer-remark , gatsby-transformer-sqip , gatsby-transformer-toml , jest-expo-enzyme , ledger-cosmos-js , ledgerhq-live-cli , ledgerhq-live-common , mdx , npm:gatsby-theme-blog-core , orama-orama , rspack , rspack-dev-server , rushstack , rushstack-heft-web-rig , rushstack-heft-webpack4-plugin , storybook , theme-ui , webpack-dev-server , xdl

Affected packages:

@pmmmwh/react-refresh-webpack-plugin @ 0.5.17 (+1752 more)