create-react-app CVE-2026-14802

The target machine must be running macOS with create-react-app version 5.0.1 or earlier. The react-dev-utils dev server must be active (i.e., the developer has run npm start or equivalent). The dev server must be reachable from a network-accessible interface - the default CRA configuration may bind to 0.0.0.0, making it network-accessible. The startBrowserProcess function in openBrowser.js must be invokable via a network path, either at dev server startup or through a specific request that triggers the browser-open code path. Exploitation is limited to macOS - the shell metacharacter behavior or the specific process-spawn mechanism appears platform-dependent per the Apple tag. No authentication is required against the dev server itself, which has no built-in auth layer. Exploitation does NOT require the developer to interact with any browser or UI once the server is running.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) characterizes this as a zero-complexity, unauthenticated, network-exploitable vulnerability - the most dangerous access profile. However, the CIA impact metrics (VC:L/VI:L/VA:L) appear significantly underscored for an OS command injection flaw, which practically enables full code execution under the developer's account. This discrepancy between the high-severity access vector and the low-impact metrics warrants verification; a CWE-78 flaw should typically carry H/H/H CIA in the vulnerable system when it reaches arbitrary command execution. The EPSS score is not provided in the input data - this represents a gap in probabilistic exploitation likelihood. A public proof-of-concept exploit exists (E:P in the CVSS 4.0 supplemental), which meaningfully raises real-world risk. There is no KEV listing, so mass exploitation is not confirmed, but the combination of public PoC, no patch, and an archived/unresponsive project creates a durable unpatched window. The most significant risk amplifier is that create-react-app dev servers commonly bind to all network interfaces and lack authentication, making any developer workstation reachable from a local network or exposed to the internet a viable target.

A developer running create-react-app's dev server on macOS on a local network with the server bound to a non-loopback interface receives a crafted network request that triggers the startBrowserProcess function with injected shell metacharacters in a browser-path or URL parameter. The unsanitized input is passed directly to a shell execution context in openBrowser.js, causing arbitrary OS commands to execute under the developer's account - potentially exfiltrating .env secrets, SSH keys, or establishing a reverse shell. A public proof-of-concept is available at the GitHub issue tracker referenced in the CVE.