HIGH
GHSA-29gp-92wp-94q8
react-dev-utils on Windows vulnerable to Remote Code Execution
Quick fix
GHSA-29gp-92wp-94q8 — react-dev-utils: upgrade to the fixed version with the command below.
npm install react-dev-utils@1.0.4Details
`react-dev-utils` on Windows is vulnerable to remote code execution.
## Recommendation
Update to one of the following versions, depending on the release line that you are using. - 1.0.4 - 2.0.2 - 3.1.2 - 4.2.2 - 5.0.2 - 6.0.0-next.a671462c
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-6342[ADVISORY]
- https://github.com/facebook/create-react-app/pull/4866[WEB]
- https://github.com/advisories/GHSA-29gp-92wp-94q8[ADVISORY]
- https://github.com/facebook/create-react-app[PACKAGE]
- https://github.com/facebook/create-react-app/releases/tag/v1.1.5[WEB]
- https://www.npmjs.com/advisories/695[WEB]