CVE-2026-14620

webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer's machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none.

• CWE-352
• CWE-749

• https://cna.openjsf.org/security-advisories.htmlThird Party Advisory
• https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-f5vj-f2hx-8m93Patch, Vendor Advisory

Published

Jul 3, 2026

Last Modified

Jul 7, 2026

Status

Analyzed

• CVE-2026-14614A flaw was found in the ClientResource component of Keycloak…5.4
• CVE-2026-14615A flaw was found in the Fine-Grained Admin Permissions (FGAP…4.3
• CVE-2026-14617A security vulnerability has been detected in NousResearch h…3.1
• CVE-2026-14618A vulnerability was detected in Open5GS up to 2.7.7. Affecte…4.3
• CVE-2026-14619A flaw has been found in itsourcecode Hospital Management Sy…6.3
• CVE-2026-1462A vulnerability in the `TFSMLayer` class of the `keras` pack…8.8
• CVE-2026-14621A vulnerability has been found in FederatedAI FATE up to 2.2…3.1
• CVE-2026-14622A vulnerability was found in jairiidriss restaurant-website-…7.3
• CVE-2026-14623A vulnerability was determined in omec-project amf up to 2.1…4.3
• CVE-2026-14624A vulnerability was identified in omec-project amf up to 2.0…4.3
• CVE-2026-14625A security flaw has been discovered in NousResearch hermes-a…6.3
• CVE-2026-14626A weakness has been identified in NousResearch hermes-agent …4.3