The React Developer Tools extension registers a message listener with...
Vulnerability Description
The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received message via fetch(). The URL is not validated or sanitised before it is fetched, thus allowing a malicious web page to arbitrarily fetch URL’s via the victim's browser.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-5654
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Calum Hutton, Snyk
More from Meta
View All →Affected Vendor
Meta
View all reports →