react-dev-utils on Windows vulnerable to Remote Code Execution

緊急 9.8CVE-2018-6342 · GHSA-29gp-92wp-94q8 · 31/12/2018 公開 · 17/06/2026 更新

要点

CVE-2018-6342 は react-dev-utils (facebook), react-dev-utils に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：2.8%（全脆弱性の 86.7% より高い）。
対処：1.0.4, 2.0.2, 3.1.2, 4.2.2 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
react-dev-utils facebook	`≥ 1.0.0, < 1.0.4≥ 2.0.0, < 2.0.2≥ 3.0.0, < 3.1.2≥ 4.0.0, < 4.2.2≥ 5.0.0, < 5.0.2`	`1.0.42.0.23.1.24.2.25.0.2`
react-dev-utils npm	`≥ 1.0.0, < 1.0.4≥ 2.0.0, < 2.0.2≥ 3.0.0, < 3.1.2≥ 4.0.0, < 4.2.2≥ 5.0.0, < 5.0.2`	`1.0.42.0.23.1.24.2.25.0.2`

概要

react-dev-utils on Windows is vulnerable to remote code execution.

Recommendation

Update to one of the following versions, depending on the release line that you are using.

1.0.4
2.0.2
3.1.2
4.2.2
5.0.2
6.0.0-next.a671462c

NVD の説明

react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editor. The input to that command was not properly sanitized, allowing an attacker who can make a network request to the server (either via CSRF or by direct request) to execute arbitrary commands on the targeted system. This issue affects multiple branches: 1.x.x prior to 1.0.4, 2.x.x prior to 2.0.2, 3.x.x prior to 3.1.2, 4.x.x prior to 4.2.2, and 5.x.x prior to 5.0.2.