| Package | Affected versions | Patched versions |
|---|---|---|
| webpack-dev-server | < 5.2.6 | 5.2.6 |
| webpack-dev-server | < 5.2.6 | 5.2.6 |
The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger them cross-origin with no interaction beyond the visit.
An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root (e.g. ~/.ssh/config). The file's contents are not returned to the attacker. Repeated requests can also spawn editor processes and force recompilations, degrading the developer's machine.
Fixed in webpack-dev-server 5.2.6 by rejecting cross-site requests to the /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints (see PR #5698).
None
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free