CVE-2026-14802: react-dev-utils openBrowser permits command injection on macOS

July 6, 2026 (updated October 1, 2026)

A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProcess of the file openBrowser.js of the component react-dev-utils. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

References

github.com/advisories/GHSA-g9g6-gvq9-j4vp
github.com/react/create-react-app/issues/17269
nvd.nist.gov/vuln/detail/CVE-2026-14802
vuldb.com/cve/CVE-2026-14802
vuldb.com/submit/850857
vuldb.com/vuln/376396
vuldb.com/vuln/376396/cti

Code Behaviors & Features

Detect and mitigate CVE-2026-14802 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →