GHSA-f5vj-f2hx-8m93
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
Quick fix
GHSA-f5vj-f2hx-8m93 — webpack-dev-server: upgrade to the fixed version with the command below.
npm install webpack-dev-server@5.2.6Details
### Impact
The internal `/webpack-dev-server/open-editor` and `/webpack-dev-server/invalidate` endpoints perform state-changing actions on any `GET` request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger them cross-origin with no interaction beyond the visit.
An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root (e.g. `~/.ssh/config`). The file's contents are not returned to the attacker. Repeated requests can also spawn editor processes and force recompilations, degrading the developer's machine.
### Patches
Fixed in `webpack-dev-server` 5.2.6 by rejecting cross-site requests to the `/webpack-dev-server/open-editor` and `/webpack-dev-server/invalidate` endpoints (see [PR #5698](https://github.com/webpack/webpack-dev-server/pull/5698)).
### Workarounds
None
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-f5vj-f2hx-8m93 [WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2026-14620 [ADVISORY]
- https://github.com/webpack/webpack-dev-server/pull/5698 [WEB]
- https://github.com/webpack/webpack-dev-server/commit/80cd9eea54975fe632a518d8bd902a260f374e7c [WEB]
- https://cna.openjsf.org/security-advisories.html [WEB]
- https://github.com/webpack/webpack-dev-server [PACKAGE]
- https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.6 [WEB]