react create-react-app vulnerabilities

Latest react create-react-app CVEs

Newest publication first

1. CVE-2026-14802 react create-react-app react-dev-utils openBrowser.js startBrowserProcess os command injection

   Published 2026-07-06

   Medium·CVSS 6.9

   A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProcess of the file openBrowser.js of the component react-dev-utils. Performing a manipulation results in os command injection. Remote exploitation of the attack is...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.