CVE-2026-14620: falha de média gravidade em webpack-dev-server
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
Publicada em · Atualizada em
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 4.7epss 0.5%
da publicação à arma45 dias
Publicada no NVD3 de jul.
1ª PoC+45d
probabilidade de exploração
0.5%top 57% das CVEs
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer's machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L
Produtos afetados
webpack-dev-server · webpack-dev-serverPoCs públicas encontradas — 1
exploitdbwww.exploit-db.com/exploits/52649não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — webpack-dev-server
No mesmo produto, das mais perigosas para as menos.
CVE-2026-14631MEDIUMwebpack-dev-server vulnerable to denial of service via a malformed Host or Origin headerEPSS 0.5%CVE-2026-6402MEDIUMwebpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS originsEPSS 0.4%CVE-2026-9595MEDIUMwebpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxiesEPSS 0.2%