## https://sploitus.com/exploit?id=F3875A46-F7ED-5DA7-B172-5AB67AADD1FF
# CVE-2026-14802
Name of the Vulnerable Software and Affected Versions
create-react-app versions prior to 5.0.2
Description
On macOS, the startBrowserProcess() function within the openBrowser.js file of the react-dev-utils component allows for OS command injection. This issue enables remote exploitation through the manipulation of the specified function.
Recommendations
As a temporary workaround, restrict the use of the startBrowserProcess() function until a patch is available.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.