CVE-2026-14620

描述

### Impact The internal `/webpack-dev-server/open-editor` and `/webpack-dev-server/invalidate` endpoints perform state-changing actions on any `GET` request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger them cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root (e.g. `~/.ssh/config`). The file's contents are not returned to the attacker. Repeated requests can also spawn editor processes and force recompilations, degrading the developer's machine. ### Patches Fixed in `webpack-dev-server` 5.2.6 by rejecting cross-site requests to the `/webpack-dev-server/open-editor` and `/webpack-dev-server/invalidate` endpoints (see [PR #5698](https://github.com/webpack/webpack-dev-server/pull/5698)). ### Workarounds None

如何修補 CVE-2026-14620

要修補 CVE-2026-14620,請將受影響套件升級到下列已修補版本。

• —升級至 5.2.6 或更新版本

CVE-2026-14620 正在被利用嗎?

低 — EPSS 為 0.1%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 5.2.6

CVSS 分數

參考連結(7)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-14620
• PATCHgithub.com/webpack/webpack-dev-server
• WEBcna.openjsf.org/security-advisories.html
• WEBgithub.com/webpack/webpack-dev-server/commit/80cd9eea54975fe632a518d8bd902a260f374e7c