CVE-2026-14620

About vulnerability

Impact

The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server’s own page. Any website a developer visits while the dev server is running can trigger them cross-origin with no interaction beyond the visit.

An attacker can open an arbitrary existing local file in the developer’s editor, including files outside the project root (e.g. ~/.ssh/config). The file’s contents are not returned to the attacker. Repeated requests can also spawn editor processes and force recompilations, degrading the developer’s machine.

Patches

Fixed in webpack-dev-server 5.2.6 by rejecting cross-site requests to the /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints (see [PR #5698](https://github.com/webpack/webpack-dev-server/pull/5698)).

Workarounds

None

Affected product:

AngularJS , React , Vue , angular-devkit-build-angular , angular-pwa , babel-plugin-remove-graphql-queries , create-react-app , create-rspack , create-storybook , docusaurus , docusaurus-core , docusaurus-plugin-content-blog , docusaurus-plugin-content-docs , docusaurus-plugin-content-pages , docusaurus-plugin-debug , docusaurus-plugin-google-analytics , docusaurus-plugin-google-gtag , docusaurus-plugin-google-tag-manager , docusaurus-plugin-sitemap , docusaurus-preset-classic , docusaurus-theme-classic , docusaurus-theme-common , docusaurus-theme-mermaid , docusaurus-theme-search-algolia , electron-webpack , expo , expo-dev-tools , expo-electron-adapter , expo-expo-cli , expo-image , expo-linking , expo-modules-core , expo-prebuild-config , expo-screen-capture , expo-standard-web-crypto , expo-status-bar , expo-symbols , expo-webpack-config , expo-xdl , expo-yarn-workspaces , gatsby , gatsby-cypress , gatsby-interface , gatsby-plugin-compile-es6-packages , gatsby-plugin-emotion , gatsby-plugin-fathom , gatsby-plugin-feed , gatsby-plugin-google-gtag , gatsby-plugin-guess-js , gatsby-plugin-less , gatsby-plugin-manifest , gatsby-plugin-netlify , gatsby-plugin-no-sourcemaps , gatsby-plugin-offline , gatsby-plugin-page-creator , gatsby-plugin-postcss , gatsby-plugin-preact , gatsby-plugin-preload-fonts , gatsby-plugin-react-helmet , gatsby-plugin-schema-snapshot , gatsby-plugin-sitemap , gatsby-plugin-styletron , gatsby-plugin-typography , gatsby-react-router-scroll , gatsby-remark-code-repls , gatsby-remark-embed-snippet , gatsby-remark-prismjs , gatsby-remark-responsive-iframe , gatsby-source-contentful , gatsby-source-drupal , gatsby-source-filesystem , gatsby-source-graphql , gatsby-source-shopify , gatsby-source-wordpress , gatsby-transformer-react-docgen , gatsby-transformer-remark , gatsby-transformer-sqip , gatsby-transformer-toml , jest-expo-enzyme , ledger-cosmos-js , ledgerhq-live-cli , ledgerhq-live-common , mdx , npm:gatsby-theme-blog-core , orama-orama , rspack , rspack-binding , rspack-cli , rspack-dev-server , rspack-test-tools , rushstack , rushstack-heft-web-rig , rushstack-heft-webpack4-plugin , rushstack-heft-webpack5-plugin , rushstack-lookup-by-path , sb , storybook , storybook-addon-a11y , storybook-addon-docs , storybook-addon-links , storybook-addon-onboarding , storybook-addon-pseudo-states , storybook-addon-themes , storybook-addon-vitest , storybook-angular , storybook-angular-vite , storybook-builder-webpack5 , storybook-cli , storybook-codemod , storybook-core-webpack , storybook-ember , storybook-html-vite , storybook-nextjs , storybook-nextjs-vite , storybook-preact , storybook-preset-create-react-app , storybook-preset-react-webpack , storybook-preset-server-webpack , storybook-react , storybook-react-dom-shim , storybook-react-native-web-vite , storybook-react-vite , storybook-react-webpack5 , storybook-server , storybook-server-webpack5 , storybook-tanstack-react , storybook-vue3 , storybook-vue3-vite , storybook-vue3-webpack5 , storybook-web-components , storybook-web-components-vite , storybook-web-components-webpack5 , theme-ui , webpack-dev-server , xdl

Affected packages:

webpack-dev-server @ 2.11.5 (+2376 more)