Vulnerability · Published Mar 9, 2021 · Assigned by facebook

CVE-2021-24033

Medium 5.6

In plain English

A medium-severity OS command injection in react-dev-utils from Facebook. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.3% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.6Medium

Exploit odds (30 days)3.3%top 11.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. Only when this function is manually invoked with user-provided values (ie: by custom code) is there the potential for command injection. If you're consuming it from react-scripts then this issue does not affect you.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	react-dev-utils	11.0.4	GHSA-5q6m-3h65-w53x

Affected products (as reported)

Vendor	Product	Versions
Facebook	react-dev-utils	unspecified – before 11.0.4

Weakness: CWE-78

References

https://github.com/facebook/create-react-app/pull/10644 x_refsource_MISC
https://www.facebook.com/security/advisories/cve-2021-24033 x_refsource_CONFIRM