CVE-2026-14802: Command Injection in create-react-app 5.0.1 macOS

Technical summary

CVE-2026-14802 is an OS command injection flaw in react-dev-utils, specifically in the startBrowserProcess function of openBrowser.js. The vulnerability stems from improper sanitization of input passed to shell command execution. Affected versions include create-react-app up to and including 5.0.1 on macOS systems. The attack leverages CWE-77 (Improper Neutralization of Special Elements used in a Command) and CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Remote exploitation is feasible because the vulnerable code path can be triggered through network-accessible development tooling or environment configurations.

Business impact

Development teams using create-react-app are at elevated risk of compromise during the build and testing phases. An attacker exploiting this vulnerability could gain code execution on developer machines, enabling theft of source code, injection of malicious dependencies, or lateral movement into internal networks. For organizations with shared development infrastructure or CI/CD pipelines, the blast radius extends to automated build systems and potentially production deployments if the compromised environment has access to release mechanisms.

Affected systems

The vulnerability affects create-react-app versions up to 5.0.1 running on macOS. The react-dev-utils component is typically bundled as a dependency of create-react-app, so any project using the vulnerable version chain is potentially exposed. Projects on Windows or Linux may have a different attack surface depending on the underlying shell behavior; however, the primary documented risk applies to macOS environments.

Exploitability

This vulnerability has a CVSS 3.1 score of 7.3 (HIGH) with a network attack vector, low attack complexity, no privilege requirements, and no user interaction needed. These characteristics indicate that exploitation is straightforward and can be initiated remotely. Public exploit information is now available, lowering the barrier to weaponization. Any developer with access to trigger a build process—whether directly or through misconfigured CI/CD—could be targeted.

Remediation

Immediate action is required: upgrade create-react-app and its bundled react-dev-utils to a patched version. Verify the latest available release and update your project's package.json or lock files accordingly. Until a patch is available from the maintainers, consider temporarily disabling automatic browser launching in development configurations or restricting build environments to isolated, ephemeral containers that do not contain sensitive credentials or source repositories.

Patch guidance

Check the official create-react-app repository and npm package registry for version 5.0.2 or later, which should address this vulnerability. Review your package-lock.json or yarn.lock to confirm the exact version of react-dev-utils in use. Update using `npm update create-react-app` or `yarn upgrade create-react-app` and verify the new version in your lockfile. If the maintainers have not yet released a patch despite early notification, monitor their issue tracker and security advisories closely for updates.

Detection guidance

Audit your npm packages with `npm list create-react-app` to identify installations of version 5.0.1 or earlier. In CI/CD environments, implement dependency scanning tools to flag vulnerable versions during build initialization. Monitor process logs on development machines and build servers for unexpected shell command execution originating from Node.js processes or browser launch sequences. Network-based detection is challenging without specific payload signatures; focus on identifying outdated create-react-app installations across your development infrastructure.

Why prioritize this

This vulnerability merits high priority due to its combination of network exploitability, lack of authentication requirements, public exploit availability, and the unpatched status at time of disclosure. Development environments are frequent targets for supply-chain attacks, and compromising them can yield access to source code and deployment credentials. The lack of vendor response despite early notification increases urgency for workarounds and vigilant monitoring.

Risk score, explained

The CVSS 7.3 (HIGH) rating reflects a remotely exploitable command injection with low complexity and broad attack surface. The network attack vector (AV:N) and absence of privilege requirements (PR:N) and user interaction (UI:N) drive the elevated score. Integrity and availability impacts are confirmed, indicating not only data exfiltration but also potential system disruption or lateral movement. The public exploit and unpatched status elevate practical risk beyond the base CVSS score.

Frequently asked questions