webpack-dev-server CSRF via open-editor and invalidate endpoints

CVE-2026-14620 is a cross-site request forgery in webpack-dev-server ≤ 5.2.5 that lets a malicious website a developer visits silently fire GET requests to two internal endpoints on localhost: /webpack-dev-server/open-editor?fileName=<path> and /webpack-dev-server/invalidate. The existing guard only blocked no-cors sub-resource requests but failed to catch navigation-mode requests (via iframe/window.open) and explicit CORS fetch calls ({mode:'cors'}). This means a drive-by page can invoke launchEditor() with an attacker-chosen file path — including paths outside the project root like ~/.ssh/config — spawning editor processes on the developer's machine. Repeated calls to /invalidate can force recompilations, degrading local build performance. Affected versions span all webpack-dev-server releases through 5.2.5; the fix shipped in 5.2.6 (PR #5698). The vulnerability also carries CWE-749 (Exposed Dangerous Method). All 4.x versions are affected as well, since the endpoints exist in that branch without origin checks.

The vendor rated this MEDIUM (4.7) and frankly that's generous even by its own CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L), which scores only a Low availability impact with zero confidentiality and zero integrity impact. The 'Changed scope' bump in the vector refers to the fact that the cross-origin page triggers actions in a different security domain (the dev server), but the real-world consequence is: some files open in your editor, and your laptop fans spin harder from forced recompilations. There is no data exfiltration path — the attacker triggers a local side-effect but receives no response data. For an enterprise managing 10,000 hosts, this vulnerability exists exclusively on developer workstations during active development. It cannot affect production servers, domain controllers, CI/CD runners (which don't browse the web), or any infrastructure tier. The vendor's MEDIUM is appropriate for an individual developer's risk but overstates the enterprise priority.

Sources.

1. GitHub Security Advisory GHSA-f5vj-f2hx-8m93
2. ExploitDB EDB-52649 — webpack_devserver 5.2.5 CSRF PoC
3. Pig-Tail Security Research — CVE-2026-14620 write-up and PoC
4. OpenCVE — CVE-2026-14620 Detail
5. webpack-dev-server npm package
6. CyberStrike — CVE-2026-14620 Detail
7. Snyk — webpack-dev-server Vulnerability Database

Run this script on any developer workstation where Node.js projects may use webpack-dev-server. It checks all node_modules directories under a given project root. No special privileges needed — run as the developer user. Example: bash check_cve_2026_14620.sh /home/dev/projects

#!/usr/bin/env bash
# check_cve_2026_14620.sh — Detect webpack-dev-server <= 5.2.5 (CVE-2026-14620)
# Usage: bash check_cve_2026_14620.sh <project_root>
# Exit codes: 0 = PATCHED/not present, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

SEARCH_ROOT="${1:-.}"
VULN_FOUND=0

if ! command -v node &>/dev/null; then
  echo "UNKNOWN — node not found on PATH; cannot check package versions"
  exit 2
fi

# Find all installed webpack-dev-server instances
while IFS= read -r -d '' pkg_json; do
  dir="$(dirname "$pkg_json")"
  name=$(node -e "try{console.log(require('$pkg_json').name||'')}catch(e){console.log('')}" 2>/dev/null)
  version=$(node -e "try{console.log(require('$pkg_json').version||'')}catch(e){console.log('')}" 2>/dev/null)

  if [[ "$name" != "webpack-dev-server" ]] || [[ -z "$version" ]]; then
    continue
  fi

  # Compare version: vulnerable if <= 5.2.5
  major=$(echo "$version" | cut -d. -f1)
  minor=$(echo "$version" | cut -d. -f2)
  patch=$(echo "$version" | cut -d. -f3 | cut -d- -f1)

  if [[ "$major" -lt 5 ]]; then
    echo "VULNERABLE — $dir: webpack-dev-server@$version (all 4.x affected)"
    VULN_FOUND=1
  elif [[ "$major" -eq 5 ]]; then
    if [[ "$minor" -lt 2 ]]; then
      echo "VULNERABLE — $dir: webpack-dev-server@$version"
      VULN_FOUND=1
    elif [[ "$minor" -eq 2 && "$patch" -le 5 ]]; then
      echo "VULNERABLE — $dir: webpack-dev-server@$version"
      VULN_FOUND=1
    else
      echo "PATCHED — $dir: webpack-dev-server@$version (>= 5.2.6)"
    fi
  else
    echo "PATCHED — $dir: webpack-dev-server@$version (>= 6.x)"
  fi
done < <(find "$SEARCH_ROOT" -path '*/node_modules/webpack-dev-server/package.json' -print0 2>/dev/null)

if [[ "$VULN_FOUND" -eq 1 ]]; then
  echo ""
  echo "VULNERABLE — one or more webpack-dev-server installations <= 5.2.5 found"
  exit 1
else
  echo ""
  echo "PATCHED — no vulnerable webpack-dev-server installations found (or not installed)"
  exit 0
fi