CVE-2026-14620: webpack-dev-server CSRF Vulnerability Allows Remote File Opening

Technical summary

The vulnerability stems from inadequate origin validation on two state-changing endpoints: /webpack-dev-server/open-editor and /webpack-dev-server/invalidate. These endpoints process GET requests that modify developer machine state—opening files in an editor and triggering bundle recompilation—without checking the Referer or Origin header or implementing Cross-Origin Resource Sharing (CORS) protections. Because GET requests are inherently cacheable and can be triggered by embedded resources or navigation, an attacker can craft a webpage that silently makes cross-origin requests to localhost:port/webpack-dev-server/invalidate or /webpack-dev-server/open-editor. The open-editor endpoint is particularly dangerous because it accepts file paths that may exist anywhere on the filesystem, not just within the project root. This violates CWE-352 (Cross-Site Request Forgery) and CWE-749 (Exposed Dangerous Method or Function).

Business impact

Developers using webpack-dev-server are at direct risk. An attacker can degrade development productivity by forcing repeated recompilations, exhausting system resources, and potentially disrupting IDE workflows. More critically, the ability to open arbitrary files in an editor—even outside the project directory—could expose sensitive configuration files, credentials, or private keys if the attacker can predict or enumerate file paths. In team environments or shared development machines, this could be a vector for lateral movement or information leakage. The attack requires only that a developer visit a malicious website while their dev server is running, a scenario that may be difficult to prevent in practice.

Affected systems

webpack-dev-server versions 5.2.5 and earlier are vulnerable. The dev server is primarily used during local development by individual developers and small teams; it is not intended for production use. However, any developer or organization using webpack-dev-server for frontend development with this or an earlier version is exposed. No bypass or workaround is documented; remediation requires upgrading to version 5.2.6.

Exploitability

Exploitability is straightforward. An attacker needs only to host a webpage (or inject content into an existing site) that makes cross-origin requests to localhost on common dev server ports (typically 8080, 8081, etc.) targeting the vulnerable endpoints. The attack requires user interaction in the form of the developer visiting the malicious page—but this is easily satisfied through phishing, social engineering, or if the attacker controls a website the developer frequents. No special privileges, authentication, or technical sophistication is required. The CVSS score of 4.7 reflects the moderate severity: the attack vector is network-based and unauthenticated, but the impact is limited to availability (recompilation delays) rather than confidentiality or integrity of source code, and it requires user interaction (the developer must visit a page).

Remediation

Upgrade webpack-dev-server to version 5.2.6 or later immediately. This release patches the vulnerability by adding proper origin validation to the vulnerable endpoints. No configuration workarounds or mitigations are available for versions 5.2.5 and earlier, so patching is the only remediation path. Development teams should audit their dependency lock files and CI/CD pipelines to ensure webpack-dev-server is pinned to a patched version going forward.

Patch guidance

Update webpack-dev-server to 5.2.6 as released. Verify the upgrade in your package.json or package-lock.json file, then rebuild your development environment. For teams using monorepos or centralized dependency management, ensure all projects referencing webpack-dev-server are updated. Consider automating this via dependency scanning tools or Dependabot to prevent regression.

Detection guidance

Monitor for unusual requests to /webpack-dev-server/* endpoints in development server logs, particularly GET requests originating from external origins. Watch for unexpected file-open events in developers' IDEs or text editors while dev servers are active. Network traffic analysis can reveal cross-origin requests to localhost dev ports from malicious external sites. Endpoint detection and response (EDR) tools may flag rapid editor process spawning or repeated compilation cycles triggered by unexpected network events.

Why prioritize this

Although rated MEDIUM severity (CVSS 4.7), this vulnerability warrants prompt patching because it directly targets developer machines and can be exploited with minimal effort by any attacker who can trick a developer into visiting a webpage. The attack surface is broad—any website the developer visits becomes a potential attack vector—and the lack of available workarounds means the only mitigation is upgrading. For organizations with large development teams, the cumulative risk of multiple developers running vulnerable versions is non-trivial.

Risk score, explained

The CVSS 4.7 score reflects: (1) network-based attack vector with no special privileges or authentication required; (2) low attack complexity; (3) user interaction necessary (developer must visit the malicious page); (4) impact scoped to the developer's machine only (not the application or broader network); (5) availability impact through resource exhaustion and disruption, but no confidentiality or integrity impact on source code itself. If an attacker successfully enumerates or predicts sensitive file paths on the developer's system, information disclosure risk could be higher, which explains why CWE-749 is flagged alongside the CSRF vulnerability.

Frequently asked questions