CVE-2026-14802

npm/react-dev-utils CVE-2026-14802: high 7.3, EPSS 2.11%

react-dev-utils openBrowser permits command injection on macOS

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-g9g6-gvq9-j4vp
• https://nvd.nist.gov/vuln/detail/CVE-2026-14802
• https://github.com/react/create-react-app/issues/17269
• https://github.com/react/create-react-app
• https://vuldb.com/cve/CVE-2026-14802
• https://vuldb.com/submit/850857
• https://vuldb.com/vuln/376396
• https://vuldb.com/vuln/376396/cti

CVE-2026-14802 · published 2026-07-06T09:30:27Z · modified 2026-10-01T21:15:05.064530826Z · JSON