CVE-2023-7080

npm/wrangler CVE-2023-7080: critical 9.3, EPSS 0.63%

Arbitrary remote code execution within `wrangler dev` Workers sandbox

Action: Upgrade wrangler to 2.20.2 or later.

npm i wrangler@3.19.0

npm i wrangler@2.20.2

Affected

Fixed versions

Sources

• osv: GHSA-f8mp-x433-5wpf
• https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-f8mp-x433-5wpf
• https://nvd.nist.gov/vuln/detail/CVE-2023-7080
• https://github.com/cloudflare/workers-sdk/issues/4430
• https://github.com/cloudflare/workers-sdk/pull/4437
• https://github.com/cloudflare/workers-sdk/pull/4535
• https://github.com/cloudflare/workers-sdk/pull/4550
• https://github.com/cloudflare/workers-sdk/commit/05b1bbd2f5b8e60268e30c276067c3a3ae1239cf
• https://github.com/cloudflare/workers-sdk/commit/29df8e17545bf3926b6d61678b596be809d40c6d
• https://github.com/cloudflare/workers-sdk/commit/49a469601adaa9eb9e1f2d6de197c1979d5c6c1b
• https://github.com/cloudflare/workers-sdk/commit/63708a94fb7a055bf15fa963f2d598b47b11d3c0
• https://github.com/cloudflare/workers-sdk

CVE-2023-7080 · published 2024-01-03T21:26:50Z · modified 2026-07-08T06:53:13.037436470Z · JSON