EUVD-2026-86461
GHSA-fqjr-2wgv-xw6r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure developer to attacker-controlled debug host
-
DeliveryDeliver crafted 'host' argument
-
ExploitTrigger Open in Editor / openDevTools handler
-
ExecutionInject OS command in electron/window.js
-
ImpactExecute arbitrary commands on developer host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to run react-native-debugger (jhen0409, versions up to 0.14.0) and use the 'Open in Editor' feature, which invokes openDevTools in electron/window.js with an attacker-influenced 'host' argument. The developer must connect the debugger to an attacker-controlled debug target/host (or process an attacker-supplied debug session), and user interaction is required (CVSS UI:P) - the injection is triggered when the editor/dev-tools open. Limiting factors: the affected population is React Native developer workstations rather than servers, exploitation is not fully automatic (requires the developer to act on an attacker-controlled host), and no authentication is involved (PR:N). |
| Impact | The signals are mixed and point to a moderate, developer-targeted risk rather than a mass-exploitation priority. The only provided score is a CVSS 4.0 vector (5.3, AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) sourced from VulDB, whose impact metrics (all Low) appear to understate a true OS command injection (CWE-78), which typically yields arbitrary code execution on the host - I assess higher confidentiality/integrity/availability impact than the vendor-of-record score reflects. Publicly available exploit code exists (a gist is referenced), which raises practical risk, but this is NOT the same as active exploitation: there is no CISA KEV listing and no EPSS score provided, so weaponization/widespread use is unconfirmed. Critically, the target is react-native-debugger, a standalone developer tool, not a server or internet-facing service, so 'launch the attack remotely' means a malicious debug target/host can reach the developer's machine - it requires the developer to run the debugger and interact (UI:P). This is a real, POC-backed issue worth patching for React Native developers, but the constrained victim population (developer workstations) and required interaction keep it below high-priority triage. Note the conflict: VulDB rates impact Low while the CWE (command injection) implies code execution - verify actual impact against the PoC before final scoring. |
| Exploit ScenarioDerived | An attacker lures a React Native developer into pointing react-native-debugger at an attacker-controlled debug host/target (or serving a malicious debug session), then triggers the 'Open in Editor' handler so that a crafted 'host' argument to openDevTools in electron/window.js is passed into an OS command. Because a public PoC exists (a referenced gist) and CVSS marks user interaction as required (UI:P), the developer's action of opening the editor/dev tools completes the injection, executing arbitrary commands on the developer's workstation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
OS command injection in jhen0409's React Native Debugger up to 0.14.0 allows remote, unauthenticated attackers to run arbitrary shell commands on a developer workstation by supplying a crafted host value that reaches the openDevTools function in electron/window.js when the victim uses the 'Open in Editor' feature against an attacker-controlled debug target. Publicly available exploit code exists (the GitHub gist referenced by VulDB), but there is no confirmed active exploitation (CISA KEV) and the vendor was contacted and did not respond, so no vendor-released patch is identified. Scoring is moderate and consistent with a developer-targeted issue rather than a mass-exploitation priority: the vendor-supplied CVSS 4.0 score is 5.3 (UI:P, E:P) and our independent CVSS 3.1 assessment is 7.8 with high confidentiality, integrity and availability impact, reflecting that a successful injection executes with the privileges of the developer's account but requires the developer to connect the debugger to an attacker-influenced host and to trigger the editor/dev-tools launch.
RemediationAI
No vendor-released patch was identified at the time of analysis, and the vendor did not respond to the disclosure, so remediation must initially rely on compensating controls. The most effective control is to never attach React Native Debugger to an untrusted or attacker-influenced debug target/host and to avoid using the 'Open in Editor' feature in such sessions, since the injection only fires when that handler processes an attacker-influenced host value; the trade-off is the loss of a convenience feature when debugging untrusted builds. Bind the debugger and the React Native packager/debug ports to localhost only (default packager port 8081 and the debugger's DevTools/HTTP ports) so remote hosts cannot present themselves as debug targets, with the trade-off that legitimate remote-device debugging over Wi-Fi must be re-enabled on demand and firewalled to known device addresses. Run the debugger in a disposable, low-privilege VM or container with no access to production credentials, SSH keys or source-control tokens, since any injected command runs with the developer's user privileges. Where the tool must be used, apply a local patch to electron/window.js so the host value is passed as an argument array via child_process.execFile/spawn (or tightly escaped and allow-listed) instead of being interpolated into a shell string; this preserves functionality but creates a fork that must be re-applied on each upgrade. Continue monitoring the upstream jhen0409 repository, the VulDB entry (https://vuldb.com/vuln/409351) and the public exploit gist (https://gist.github.com/Suuuuuzy/d25baf1973fd3c812277e02cde2243cc) for a fixed release, and upgrade as soon as one is published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
React Native Debugger is an Electron-based desktop application that bundles the React Native packager/debugging workflow with a Chromium DevTools frontend, letting developers attach to a running React Native app. The vulnerable element is the openDevTools function in the Electron main-process file electron/window.js, within the component it labels the 'Open in Editor Handler'. That handler constructs a shell command to launch the user's editor (or dev-tools) using a host argument derived from the debug target or session; because the value is concatenated into a shell invocation without neutralization, shell metacharacters (command separators, pipes, command substitution) allow an attacker who controls the debug host or session data to inject and execute arbitrary OS commands. The root cause class is CWE-78 (Improper Neutralization of Special Elements used in an OS Command / OS Command Injection). The CPE cpe:2.3:a:jhen0409:react-native-debugger:*:*:*:*:*:*:*:* uses a wildcard version, indicating all released versions through 0.14.0 are affected. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L) and our independent CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) agree there is no authentication boundary (PR:N) but that exploitation is not fully automatic and hinges on user interaction and the developer acting on an attacker-controlled host; the divergence in AC/UI and impact reflects differing assumptions about how reliably a malicious host reaches the vulnerable code path and what privileges the injected command inherits.
Know when Electron gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
OS command injection yields arbitrary code execution (C/I/A:H); it requires luring the developer to an attacker-controlled host and user interaction, so AC:H and UI:R with PR:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of the file electron/window.js of the component Open in Editor Handler. The manipulation of the argument host results in os command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the pro
Cross-site scripting in DeepChat's Mermaid diagram renderer escalates to full remote code execution on affected desktop
Remote code execution in DeepChat 0.5.1 and below is possible through a cross-site scripting flaw in Mermaid diagram ren
Stored cross-site scripting in SiYuan through 3.8.4 lets an attacker who can set a notebook name containing an HTML payl
GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. Rated hi
GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindow
Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values
electron-updater allows for automatic updates for Electron apps. Rated high severity (CVSS 7.5), this vulnerability is r
Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fe
Native code execution outside the Chromium sandbox is achievable in Electron prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Rated critical severity
Privilege escalation in the Electron framework lets a <webview> guest grant itself Node.js integration inside its Web Wo
Exploit-DB