webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
GHSA-f5vj-f2hx-8m93 · CVE-2026-14620
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger them cross-origin with no interaction beyond the visit.
An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root (e.g. ~/.ssh/config). The file's contents are not returned to the attacker. Repeated requests can also spawn editor processes and force recompilations, degrading the developer's machine.
Patches
Fixed in webpack-dev-server 5.2.6 by rejecting cross-site requests to the /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints (see PR #5698).
Workarounds
None
References
- WEB https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-f5vj-f2hx-8m93
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-14620
- WEB https://github.com/webpack/webpack-dev-server/pull/5698
- WEB https://github.com/webpack/webpack-dev-server/commit/80cd9eea54975fe632a518d8bd902a260f374e7c
- WEB https://cna.openjsf.org/security-advisories.html
- PACKAGE https://github.com/webpack/webpack-dev-server
- WEB https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.6
Ready to move
Start Securing
Free, no credit card | First findings in minutes