CVE-2026-97366
jhen0409 react-native-debugger Open in Editor window.js openDevTools os command injection
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 24, 2026
- Updated
- Sep 25, 2026
- Reserved
- Sep 24, 2026
Description
A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of the file electron/window.js of the component Open in Editor Handler. The manipulation of the argument host results in os command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
react-native-debuggerjhen0409 |
|
References
- VDB-409351 | jhen0409 react-native-debugger Open in Editor window.js openDevTools os command injectionvdb-entrytechnical-description
- VDB-409351 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-97366 | CVE Analysis and Reportthird-party-advisory
- Submit #909329 | React Native Debugger v0.14.0 Improper Control of Generation of Codethird-party-advisory
- https://gist.github.com/Suuuuuzy/d25baf1973fd3c812277e02cde2243ccexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.