Executive brief
A vulnerability in the webpack-dev-server, a tool used by developers to preview web applications, allows malicious websites to interfere with a developer's local machine. If a developer visits a compromised site while the server is running, an attacker can force the developer's code editor to open sensitive local files or repeatedly trigger resource-intensive tasks. This can lead to a loss of productivity and potential exposure of local file paths, though the actual content of the files is not directly sent to the attacker.
Technical details
The internal `/webpack-dev-server/open-editor` and `/webpack-dev-server/invalidate` endpoints in webpack-dev-server perform state-changing actions upon receiving HTTP GET requests without implementing CSRF protections. Because these endpoints do not verify the origin of the request, a remote attacker can use a malicious website to trigger these actions via a developer's browser. An exploit can force the developer's local editor to open arbitrary files (including those outside the project root like SSH configs) or trigger repeated recompilations and process spawning to cause a Denial of Service (DoS) on the developer's machine. The issue is fixed in version 5.2.6 by rejecting cross-site requests to these endpoints.
Affected products
- webpack webpack-dev-server <= 5.2.5
Timeline
- 2026-07-03: disclosed
- 2026-07-20: advisory: GitHub Advisory published
- 2026-07-20: patched: Fixed in version 5.2.6