CVE-2018-6342: Cross-Site Request Forgery (CSRF)

December 31, 2018 (updated October 9, 2019)

react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editor. The input to that command was not properly sanitized, allowing an attacker who can make a network request to the server (either via CSRF or by direct request) to execute arbitrary commands on the targeted system.

References

nvd.nist.gov/vuln/detail/CVE-2018-6342

Code Behaviors & Features

Detect and mitigate CVE-2018-6342 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →