React Native Debugger
Monthly
OS command injection in jhen0409's React Native Debugger up to 0.14.0 allows remote, unauthenticated attackers to run arbitrary shell commands on a developer workstation by supplying a crafted host value that reaches the openDevTools function in electron/window.js when the victim uses the 'Open in Editor' feature against an attacker-controlled debug target. Publicly available exploit code exists (the GitHub gist referenced by VulDB), but there is no confirmed active exploitation (CISA KEV) and the vendor was contacted and did not respond, so no vendor-released patch is identified. Scoring is moderate and consistent with a developer-targeted issue rather than a mass-exploitation priority: the vendor-supplied CVSS 4.0 score is 5.3 (UI:P, E:P) and our independent CVSS 3.1 assessment is 7.8 with high confidentiality, integrity and availability impact, reflecting that a successful injection executes with the privileges of the developer's account but requires the developer to connect the debugger to an attacker-influenced host and to trigger the editor/dev-tools launch.
OS command injection in jhen0409's React Native Debugger up to 0.14.0 allows remote, unauthenticated attackers to run arbitrary shell commands on a developer workstation by supplying a crafted host value that reaches the openDevTools function in electron/window.js when the victim uses the 'Open in Editor' feature against an attacker-controlled debug target. Publicly available exploit code exists (the GitHub gist referenced by VulDB), but there is no confirmed active exploitation (CISA KEV) and the vendor was contacted and did not respond, so no vendor-released patch is identified. Scoring is moderate and consistent with a developer-targeted issue rather than a mass-exploitation priority: the vendor-supplied CVSS 4.0 score is 5.3 (UI:P, E:P) and our independent CVSS 3.1 assessment is 7.8 with high confidentiality, integrity and availability impact, reflecting that a successful injection executes with the privileges of the developer's account but requires the developer to connect the debugger to an attacker-influenced host and to trigger the editor/dev-tools launch.