CVE-2026-14620
published 2026-07-03CVE-2026-14620: webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that…
PriorityP434medium4.7CVSS 3.1
AVNACLPRNUIRSCCNINAL
EXPLOIT
EPSS
0.52%
43.3th percentile
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer's machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none.
Affected
44 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-24 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-26 | gateway-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-27 | gateway-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-rhel9 | — | — |
| ansible-automation-platform | automation-portal | — | — |
| clusterlabs | pcs | — | — |
| container-native-virtualization | kubevirt-console-plugin | — | — |
| container-native-virtualization | kubevirt-console-plugin-rhel9 | — | — |
| discovery | discovery-ui-rhel9 | — | — |
| gatekeeper | gatekeeper-rhel9 | — | — |
| grafana | grafana | — | — |
| openshift-lightspeed | lightspeed-console-plugin-419-rhel9 | — | — |
| openshift-lightspeed | lightspeed-console-plugin-pf5-rhel9 | — | — |
| openshift-lightspeed | lightspeed-console-plugin-rhel9 | — | — |
| openshift-pipelines | pipelines-console-plugin-pf5-rhel9 | — | — |
| openshift-pipelines | pipelines-console-plugin-rhel8 | — | — |
| openshift-pipelines | pipelines-console-plugin-rhel9 | — | — |
| openshift-pipelines | pipelines-hub-ui-rhel8 | — | — |
| openshift-pipelines | pipelines-hub-ui-rhel9 | — | — |
| openshift-service-mesh | kiali-operator-bundle | — | — |
| openshift-service-mesh | kiali-ossmc-rhel9 | — | — |
| openshift-service-mesh | kiali-rhel9 | — | — |
| openshift-service-mesh | kiali-rhel9-operator | — | — |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L
vendor_redhat4.7MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
ghsa·2026-07-20
CVE-2026-14620 [MEDIUM] CWE-352 webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
### Impact
The internal `/webpack-dev-server/open-editor` and `/webpack-dev-server/invalidate` endpoints perform state-changing actions on any `GET` request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger them cross-origin with no interaction beyond the visit.
An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root (e.g. `~/.ssh/config`). The file's contents are not returned to the attacker. Repeated requests can also spawn editor processes and force recompilations, degrading the developer's machine.
### Patches
Fixed in `we
VulDB
webpack-dev-server up to 5.2.5 GET Request open-editor cross-site request forgery (GHSA-f5vj-f2hx-8m93 / EUVD-2026-41558)
vuldb·2026-07-03·CVSS 4.7
CVE-2026-14620 [MEDIUM] webpack-dev-server up to 5.2.5 GET Request open-editor cross-site request forgery (GHSA-f5vj-f2hx-8m93 / EUVD-2026-41558)
A vulnerability classified as problematic was found in webpack-dev-server up to 5.2.5. The impacted element is an unknown function of the file /webpack-dev-server/open-editor of the component GET Request Handler. The manipulation results in cross-site request forgery.
This vulnerability is reported as CVE-2026-14620. The attack can be launched remotely. No exploit exists.
Upgrading the affected component is advised.
Red Hat
webpack-dev-server: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints
vendor_redhat·2026-07-03·CVSS 4.7
CVE-2026-14620 [MEDIUM] CWE-940 webpack-dev-server: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints
webpack-dev-server: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer's machine. Patches: upgrade
No detection rules found.
Bugzilla
CVE-2026-14620 grafana: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints [fedora-all]
bugzilla·2026-07-06·CVSS 4.7
CVE-2026-14620 [MEDIUM] CVE-2026-14620 grafana: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints [fedora-all]
CVE-2026-14620 grafana: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacke
Bugzilla
CVE-2026-14620 fbthrift: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints [fedora-all]
bugzilla·2026-07-06·CVSS 4.7
CVE-2026-14620 [MEDIUM] CVE-2026-14620 fbthrift: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints [fedora-all]
CVE-2026-14620 fbthrift: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attack
Bugzilla
CVE-2026-14620 fbthrift: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints [epel-all]
bugzilla·2026-07-06·CVSS 4.7
CVE-2026-14620 [MEDIUM] CVE-2026-14620 fbthrift: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints [epel-all]
CVE-2026-14620 fbthrift: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker
Bugzilla
CVE-2026-14620 js-d3-flame-graph: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints [fedora-all]
bugzilla·2026-07-06·CVSS 4.7
CVE-2026-14620 [MEDIUM] CVE-2026-14620 js-d3-flame-graph: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints [fedora-all]
CVE-2026-14620 js-d3-flame-graph: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit.
Bugzilla
CVE-2026-14620 cachelib: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints [fedora-all]
bugzilla·2026-07-06·CVSS 4.7
CVE-2026-14620 [MEDIUM] CVE-2026-14620 cachelib: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints [fedora-all]
CVE-2026-14620 cachelib: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attack
Bugzilla
CVE-2026-14620 cachelib: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints [epel-all]
bugzilla·2026-07-06·CVSS 4.7
CVE-2026-14620 [MEDIUM] CVE-2026-14620 cachelib: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints [epel-all]
CVE-2026-14620 cachelib: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker
Bugzilla
CVE-2026-14620 h3: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints [fedora-all]
bugzilla·2026-07-06·CVSS 4.7
CVE-2026-14620 [MEDIUM] CVE-2026-14620 h3: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints [fedora-all]
CVE-2026-14620 h3: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can
Bugzilla
CVE-2026-14620 fcitx5: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints [fedora-all]
bugzilla·2026-07-06·CVSS 4.7
CVE-2026-14620 [MEDIUM] CVE-2026-14620 fcitx5: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints [fedora-all]
CVE-2026-14620 fcitx5: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker
Bugzilla
CVE-2026-14620 webpack-dev-server: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints
bugzilla·2026-07-03·CVSS 4.7
CVE-2026-14620 [MEDIUM] CVE-2026-14620 webpack-dev-server: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints
CVE-2026-14620 webpack-dev-server: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints
webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer's machine. Pa
2026-07-03
Published