CVE-2026-14620: webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server’s own page. Any website a developer visits while the dev server is running can trigger them cross-origin with no interaction beyond the visit.
An attacker can open an arbitrary existing local file in the developer’s editor, including files outside the project root (e.g. ~/.ssh/config). The file’s contents are not returned to the attacker. Repeated requests can also spawn editor processes and force recompilations, degrading the developer’s machine.
References
- cna.openjsf.org/security-advisories.html
- github.com/advisories/GHSA-f5vj-f2hx-8m93
- github.com/webpack/webpack-dev-server/commit/80cd9eea54975fe632a518d8bd902a260f374e7c
- github.com/webpack/webpack-dev-server/pull/5698
- github.com/webpack/webpack-dev-server/releases/tag/v5.2.6
- github.com/webpack/webpack-dev-server/security/advisories/GHSA-f5vj-f2hx-8m93
- nvd.nist.gov/vuln/detail/CVE-2026-14620
Code Behaviors & Features
Detect and mitigate CVE-2026-14620 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →