CVE-2026-14620: webpack.js webpack-dev-server

csirt@kutim:~/threat-intel/cve/CVE-2026-14620

CVSS 4.7 · Medium EPSS 0,52%

Kerentanan Cross-Site Request Forgery (CSRF) pada webpack.js webpack-dev-server. Skor CVSS 3.1 4.7 (Medium) menurut NVD.

Deskripsi (NVD)

webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer's machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none.

Rincian

Terbit di NVD: 3 Juli 2026
Terakhir diubah: 7 Juli 2026
Status NVD: Analyzed
CVSS 3.1: 4.7 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-352: Cross-Site Request Forgery (CSRF)
CWE-749: Exposed Dangerous Method or Function
EPSS (30 hari): 0,52% peluang dieksploitasi; lebih tinggi dari 42,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
webpack.js	webpack-dev-server	Semua versi sebelum 5.2.6

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-f5vj-f2hx-8m93 patch · advisory vendor
https://cna.openjsf.org/security-advisories.html advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.