Packages / react-devtools-core / Security

ModerateVulnerabilityGHSA-rxrc-rgv4-jpvxCVE-2023-5654Published 19 Oct 2023

React Developer Tools extension Improper Authorization vulnerability

Affected releases · react-devtools-core

  • 4.x4.0.0 – 4.28.0Fixed in 4.28.4
  • 3.x and older1.0.5 – 3.6.3No fix, no longer updated

On 4.x, the newest line:

npm install react-devtools-core@4.28.4
8.x

  1. Not affected

    8.0.0

    1 release, latest

4.x

  1. Affected

    4.0.0 – 4.28.0

    73 releases

  2. Fixed

    4.28.4 – 4.28.5

    2 releases

3.x

  1. Affected

    3.0.0 – 3.6.3

    21 releases

2.x

  1. Affected

    2.0.0 – 2.5.2

    32 releases

1.x

  1. Affected

    1.0.5 – 1.0.6

    2 releases

148 stable releases of react-devtools-core, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for react-devtools-core. It is read in your browser and sent nowhere.

What happens

The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received message via fetch(). The URL is not validated or sanitised before it is fetched, thus allowing a malicious web page to arbitrarily fetch URL’s via the victim's browser.