-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @react-native-community/cli | npm | < 20.0.0 | 20.0.0 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability exists in the openURLMiddleware function in the file packages/cli-server-api/src/openURLMiddleware.ts. The function receives a URL from a POST request and uses the open library to open it. The vulnerability lies in the fact that the open library can execute system commands, and the URL from the request is not sanitized before being passed to it. This allows an attacker to craft a malicious URL that can execute arbitrary commands on the host system. The patch mitigates this by adding strict URL validation, ensuring that only http and https protocols are allowed, thus preventing the execution of local files or commands.
openURLMiddlewarepackages/cli-server-api/src/openURLMiddleware.ts
Ongoing coverage of React2Shell