Is there a public PoC exploit available for CVE-2026-14802?

Yes, a public proof-of-concept exploit is available for CVE-2026-14802. Prioritise patching immediately. EPSS: 1.3%.

create-react-app CVE-2026-14802

Q: What is the CVSS score of CVE-2026-14802?

CVE-2026-14802 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.3%.

EUVD-2026-41815 MEDIUM

OS Command Injection (CWE-78)

2026-07-06 VulDB

GHSA-g9g6-gvq9-j4vp

Command Injection Apple React Create React App

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

OS command injection enabling arbitrary code execution warrants C:H/I:H/A:H; dev server binds to network with no auth, so AV:N/PR:N/AC:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 06, 2026 - 08:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 06, 2026 - 07:53 vuln.today

CVE Published

Jul 06, 2026 - 06:30 cve.org

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProcess of the file openBrowser.js of the component react-dev-utils. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

OS command injection in create-react-app's react-dev-utils component enables remote code execution on macOS developer workstations running version 5.0.1 or earlier. The vulnerability resides in the startBrowserProcess function of openBrowser.js, which processes unsanitized input that reaches a shell invocation. A publicly available proof-of-concept exploit exists via the project's GitHub issue tracker; no vendor patch has been released and the maintainers have not responded to disclosure, leaving the entire supported version history of this widely-used but now-archived tool permanently unpatched.

Technical ContextAI

create-react-app (CPE: cpe:2.3:a:react:create-react-app:*:*:*:*:*:*:*:*) bundles react-dev-utils, a helper library that manages the development server lifecycle. The openBrowser.js module's startBrowserProcess function constructs a shell command to launch a browser when the dev server initializes or handles certain requests. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) identifies the root cause: user-controlled or network-influenced data flows into a child_process execution context without adequate sanitization or escaping. On macOS, this is compounded by shell metacharacter interpretation, allowing semicolons, pipes, backticks, or $() substitutions to break out of the intended browser-launch context and execute arbitrary system commands under the developer's user account. The macOS-specific tagging suggests the injection vector or shell behavior is platform-dependent.

RemediationAI

No vendor-released patch has been identified at time of analysis - the project maintainers have not responded to the disclosed issue (https://github.com/react/create-react-app/issues/17269). The primary recommended remediation is migration away from create-react-app to an actively maintained alternative such as Vite or Next.js, which eliminates exposure entirely. For teams unable to migrate immediately, restrict the create-react-app dev server to the loopback interface (127.0.0.1) only, preventing network-based exploitation; this can be enforced via HOST=127.0.0.1 in the project's .env file (trade-off: breaks dev access from other machines on the network). Additionally, ensure dev servers are never exposed to untrusted networks or the public internet, and audit firewall rules to block access to the default port 3000 from external interfaces. Setting BROWSER=none in the environment disables the browser-launch functionality entirely and eliminates the vulnerable code path, at the cost of losing automatic browser-open behavior on dev server start.