webpack-dev-server CVE-2026-14620

Exploitation requires three concurrent conditions on the developer's workstation: (1) webpack-dev-server 5.2.5 or earlier must be actively running and listening on a known or guessable port (commonly 8080, 3000, or similar defaults); (2) the developer must visit a web page controlled by or injected with attacker content - a single passive page load suffices, no click-through interaction is needed beyond navigation; (3) the browser must be able to reach the localhost dev server port, which is the default state for any browser on the same machine. Exploitation is limited to: developer workstations only (not production servers); the specific port the dev server is bound to; and the 5.2.5-and-earlier codebase. No authentication is required because dev server endpoints are intentionally unauthenticated. The CVSS PR:N confirms no credential requirement. The file-opening impact is bounded by the OS user permissions of the process running the editor - root-owned files would require the developer to run as root, which is non-default.

The CVSS 3.1 base score of 4.7 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L correctly reflects that no authentication is required and the scope change (S:C) captures the boundary crossing from browser to local OS. However, several signals suggest the real-world developer-impact is higher than the numerical score implies: the open-editor endpoint accepts arbitrary file paths with no apparent sanitization, meaning sensitive files such as SSH keys or tokens could be surfaced in the editor even though the attacker cannot exfiltrate them remotely (hence C:N is defensible but represents an indirect exposure risk). UI:R is technically accurate but the required interaction is trivially achieved - a single page load via a phishing link, malicious ad, or compromised npm documentation page suffices. No EPSS data was provided in the input, so exploitation probability is not quantifiable. No CISA KEV listing and no confirmed POC exists, suggesting this has not yet been broadly weaponized. The attack surface is narrowly constrained to active development sessions, which limits blast radius but makes developer-targeted supply-chain campaigns a plausible threat scenario.

A developer running webpack-dev-server 5.2.5 on localhost port 8080 clicks a phishing link in a Slack message or visits a page with a malicious advertisement. The page's JavaScript fires a GET request to http://localhost:8080/webpack-dev-server/open-editor?fileName=../../.ssh/id_rsa, which causes the developer's configured editor to open the SSH private key file with no visible warning, while a concurrent loop of requests to /webpack-dev-server/invalidate forces continuous recompilation cycles that slow the workstation. No POC has been publicly identified, but the attack requires no exploit complexity beyond standard JavaScript fetch calls.