# CVE-2023-7080: Cloudflare Wrangler arbitrary code execution in dev inspector

Source: https://junglewise.ai/threats/cve-2023-7080-cloudflare-wrangler-arbitrary-code-execution-in-dev-inspector  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-01-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-7080 · Severity: low · CVSS 3.1 · Published 2024-01-03

Wrangler is a developer tool used to build and test Cloudflare Workers serverless applications. The development server (`wrangler dev`) exposed a V8 debugging inspector on all network interfaces without proper access controls, allowing attackers on the local network or via malicious websites to execute arbitrary code within the Workers sandbox and potentially access production resources.

Technologies: [wrangler (npm)](https://junglewise.ai/threats/technologies/wrangler). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-7080 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-7080 being exploited in the wild.

**How severe is CVE-2023-7080?** Low severity, with a CVSS score of 3.1, published 3 January 2024.

**Which products and versions are affected?** wrangler (npm) SEMVER:introduced=3.0.0,fixed=3.19.0.

**Is there a fix for CVE-2023-7080?** Yes. wrangler (npm): upgrade to 3.19.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-7080 attacked?** It is attacked from the adjacent network or over the network.

**Am I affected by CVE-2023-7080?** Check whether you run wrangler (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- wrangler (npm): upgrade to 3.19.0 or later

  ```sh
  npm install wrangler@3.19.0
  ```


## Technical details

The V8 inspector in `wrangler dev` intentionally allows arbitrary code execution for debugging purposes, but was exposed on all network interfaces without Origin/Host header validation. This enabled two attack vectors: (1) a direct network-based attack where an attacker on the same local network could connect directly to the inspector and execute code, and (2) a cross-origin attack where a user visiting a malicious website could be tricked into connecting to the inspector. When using `wrangler dev --remote`, this could grant attackers access to production resources bound to the worker. Patches were released in wrangler v3.19.0 and v2.20.2 with Origin/Host header validation; earlier mitigations included binding the inspector to localhost (v3.16.0) and SSRF vulnerability fixes in miniflare (v3.18.0).

## Affected products

- Cloudflare Wrangler >=2.0.0, <2.20.2 and >=3.0.0, <3.19.0

## Identifiers

- CVE-2023-7080
- GHSA-f8mp-x433-5wpf

## Timeline

- 2023-12-29: disclosed
- 2024-01-03: patched: wrangler v3.19.0 and v2.20.2 released with fixes

## References

- [https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-f8mp-x433-5wpf](https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-f8mp-x433-5wpf)

## Related threats

- [Cloudflare Wrangler OS command injection in pages deploy](https://junglewise.ai/threats/cloudflare-wrangler-os-command-injection-in-pages-deploy-05ff18ee)
- [Cloudflare Wrangler dev server arbitrary file read](https://junglewise.ai/threats/cve-2023-7079-cloudflare-wrangler-dev-server-arbitrary-file-read)
- [Cloudflare Wrangler directory traversal vulnerability](https://junglewise.ai/threats/cve-2023-3348-cloudflare-wrangler-directory-traversal-vulnerability)