CVE-2026-14802: React create-react-app OS command injection in react-dev-utils

Executive brief

A vulnerability in a popular tool used by web developers to build React applications could allow an attacker to take control of a developer's computer. The issue occurs when the tool automatically opens a web browser on macOS; if a malicious web address is processed, it can trigger the execution of unauthorized commands. This could lead to the theft of sensitive source code, credentials, or full system compromise of a developer's workstation.

Technical details

An OS command injection vulnerability exists in the `startBrowserProcess` function within `openBrowser.js` of the `react-dev-utils` component (used by `create-react-app`). On macOS, the library uses `child_process.execSync` to execute an AppleScript for opening Chrome. The implementation relies on `encodeURI()` to sanitize the URL, which fails to escape shell-significant characters like ` , `(`, and `)`. Because the URL is interpolated into a double-quoted string executed via `/bin/sh`, an attacker can use command substitution (e.g., `$(command)`) to achieve arbitrary code execution. This affects versions up to 5.0.1 (specifically `react-dev-utils` v12.0.1) and currently has no official patch.

Affected products

• React create-react-app up to 5.0.1
• React react-dev-utils 12.0.1

Timeline

• 2026-06-07: disclosed: Issue reported on GitHub repository
• 2026-07-06: advisory: CVE published to NVD

References

• https://github.com/react/create-react-app/
• https://github.com/react/create-react-app/issues/17269
• https://vuldb.com/cve/CVE-2026-14802
• https://vuldb.com/submit/850857
• https://vuldb.com/vuln/376396
• https://vuldb.com/vuln/376396/cti