What’s Vulnerable › Vulnerabilities

CVE-2023-5654

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-10-19 · updated 2026-06-17
• Weakness: CWE-285

Description

The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received message via fetch(). The URL is not validated or sanitised before it is fetched, thus allowing a malicious web page to arbitrarily fetch URL’s via the victim's browser.

Affected products

• Meta React Developer Tools Extension: before 4.28.4 — fixed in 4.28.4

How to fix

Upgrade to a fixed version: Meta React Developer Tools Extension 4.28.4. Check the vendor advisory for mitigations.

References

• https://gist.github.com/CalumHutton/1fb89b64409570a43f89d1fd3274b231
• https://gist.github.com/CalumHutton/1fb89b64409570a43f89d1fd3274b231

Get alerted when CVE-2023-5654 or the next vulnerability affects your stack