npm react-devtools-core vulnerabilities

Latest npm react-devtools-core CVEs

Newest publication first

1. CVE-2023-5654 React Developer Tools extension Improper Authorization vulnerability

   Published 2023-10-19

   Medium·CVSS 6.5

   The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received mess...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.