Name of the Vulnerable Software and Affected Versions create-react-app versions prior to 5.0.2 Description On macOS, the startBrowserProcess() function within the openBrowser.js file of the react-dev-utils component allows for OS command injection. This issue enables remote exploitation through the manipulation of the specified function. Recommendations As a temporary workaround, restrict the use of the startBrowserProcess() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
