CVE-2021-24033
react-dev-utils OS Command Injection in function `getProcessForPort`
Reported by facebook · Published March 9, 2021
react-dev-utils is fixed in 11.0.4 (npm)
react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. Only when this function is manually invoked with user-provided values (ie: by custom code) is there the potential for command injection. If you're consuming it from react-scripts then this issue does not affect you.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| react-dev-utils | npm | 11.0.4 |
| react-dev-utils | unspecified, 11.0.4 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| react-dev-utils | 11.0.4, unspecified | |
| npm | react-dev-utils | 0 |
| react-dev-utils | 11.0.4, * | |
| react-dev-utils |
Timeline
- Mar 9, 2021 CVE Published
- Mar 9, 2021 PoC Published
- Apr 14, 2021 EPSS Score (30 in total, the first dated here)
- Mar 9, 2026 Security Advisory
- Jun 17, 2026 CVE Updated
- Aug 23, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2021-24033
vulnetix vdb fixes CVE-2021-24033Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-24033/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- x_refsource_MISC
- x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2021-24033 advisory