N/A

react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editor. The input to that command was not properly sanitized, allowing an attacker who can make a network request to the server (either via CSRF or by direct request) to execute arbitrary commands on the targeted system. This issue affects multiple branches: 1.x.x prior to 1.0.4, 2.x.x prior to 2.0.2, 3.x.x prior to 3.1.2, 4.x.x prior to 4.2.2, and 5.x.x prior to 5.0.2.

N/A

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

react-dev-utils 安全漏洞

react-dev-utils是一个实用程序集。 基于Windows平台的react-dev-utils中存在安全漏洞。攻击者可通过向服务器发送网络请求利用该漏洞在目标系统上执行任意命令。以下版本受到影响：react-dev-utils 1.0.4之前的1.x.x版本，2.0.2之前的2.x.x版本，3.1.2之前的3.x.x版本，4.2.2之前的4.x.x版本，5.0.2之前的5.x.x版本。

N/A

N/A