Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTI5Z3AtOTJ3cC05NHE4

react-dev-utils on Windows vulnerable to Remote Code Execution

react-dev-utils on Windows is vulnerable to remote code execution.

Recommendation

Update to one of the following versions, depending on the release line that you are using.

1.0.4
2.0.2
3.1.2
4.2.2
5.0.2
6.0.0-next.a671462c

Permalink: https://github.com/advisories/GHSA-29gp-92wp-94q8
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTI5Z3AtOTJ3cC05NHE4
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 5 years ago
Updated: over 1 year ago

Identifiers: GHSA-29gp-92wp-94q8, CVE-2018-6342
References:

Repository: https://github.com/facebook/create-react-app
Blast Radius: 0.0

Affected Packages

npm:react-dev-utils

Dependent packages: 8,469
Dependent repositories: 1,536,581
Downloads: 18,262,797 last month
Affected Version Ranges: >= 5.0.0, < 5.0.2, >= 4.0.0, < 4.2.2, >= 3.0.0, < 3.1.2, >= 2.0.0, < 2.0.2, >= 1.0.0, < 1.0.4
Fixed in: 5.0.2, 4.2.2, 3.1.2, 2.0.2, 1.0.4
All affected versions: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 2.0.0, 2.0.1, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 3.1.1, 4.0.0, 4.0.1, 4.1.0, 4.2.0, 4.2.1, 5.0.0, 5.0.1
All unaffected versions: 0.0.0, 0.1.0, 0.1.1, 0.2.0, 0.2.1, 0.3.0, 0.4.0, 0.4.1, 0.4.2, 0.5.0, 0.5.1, 0.5.2, 1.0.4, 1.0.5, 2.0.2, 2.0.3, 3.1.2, 3.1.3, 4.2.2, 4.2.3, 5.0.2, 5.0.3, 6.0.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.1.0, 6.1.1, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 8.0.0, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.1.0, 10.0.0, 10.1.0, 10.2.0, 10.2.1, 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, 12.0.0, 12.0.1