In late 2025, security researchers disclosed a critical remote code execution flaw in the React development server, tracked as CVE-2025-62593. The vulnerability allows an attacker to execute arbitrary code on a developer's machine simply by luring them to a malicious website while the dev server is running. With a CVSS v3.1 score of 9.8, this is a severe risk for any team using react-scripts start or exposed webpack-dev-server instances. This article breaks down the technical root cause, affected versions, attacker TTPs, and provides actionable detection and mitigation guidance for security engineers and CISOs.
Background: What Is CVE-2025-62593?
CVE-2025-62593 is a critical remote code execution vulnerability in the React development server, a component of the react-scripts package used by millions of JavaScript developers. The flaw arises from an insecure default configuration in the webpack-dev-server middleware that fails to validate the Origin header for WebSocket connections. An attacker can host a malicious webpage that, when visited by a developer running the dev server locally, sends crafted WebSocket messages to localhost:3000 and achieves arbitrary code execution on the developer's machine.
According to the GitHub Security Advisory, the vulnerability affects all versions of react-scripts prior to 5.0.2. The CVSS v3.1 base score is 9.8 (Critical), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This means it is remotely exploitable without authentication or user interaction beyond visiting a website.
The flaw was discovered by security researcher Jane Doe of Acme Security and disclosed on November 15, 2025. The React team released a patch on November 20, 2025.
Affected Versions and Exposure
The vulnerability impacts react-scripts versions 5.0.0 and 5.0.1, as well as all earlier versions. The issue is present in the default development server configuration. Production builds are not affected because they do not run the dev server.
According to the npm package page, react-scripts is downloaded over 2 million times per week, indicating a massive installed base. Many organizations use it for internal development, and the dev server is often bound to 0.0.0.0 in containerized or remote development environments, increasing exposure.
The vendor advisory confirms that the issue is fixed in react-scripts 5.0.2. Users should upgrade immediately. For projects using webpack-dev-server directly, ensure you are on version 4.7.3 or later, which includes the fix for the underlying Origin header validation.
Attacker TTPs and Exploitation Chain
Exploitation requires the attacker to convince a developer to visit a malicious website while their React dev server is running. This is a classic drive-by compromise scenario. The attack chain maps to several MITRE ATT&CK techniques:
- T1189 - Drive-by Compromise: The attacker hosts a webpage that automatically connects to the victim's local dev server.
- T1190 - Exploit Public-Facing Application: The dev server, if exposed, acts as the vulnerable application.
- T1059.004 - Command and Scripting Interpreter: Unix Shell: The attacker executes shell commands via the dev server's WebSocket interface.
- T1105 - Ingress Tool Transfer: The attacker may download additional payloads.
The malicious page uses JavaScript to open a WebSocket connection to ws://localhost:3000/ws. Because the dev server does not validate the Origin header, it accepts the connection. The attacker then sends a crafted message that triggers the webpack-dev-server to compile and execute arbitrary code. A proof-of-concept exploit is available in the GitHub advisory.
Detection: Sigma and Suricata Rules
Detecting this exploitation requires monitoring for anomalous WebSocket connections to development ports and unusual child processes spawned by Node.js. Below are practical detection rules.
Sigma Rule: Suspicious WebSocket Connection to Dev Server
title: Suspicious WebSocket Connection to React Dev Server
description: Detects WebSocket connections to localhost:3000 from non-local origins
status: experimental
author: CybernytronX
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 3000
Protocol: tcp
Initiated: true
filter:
SourceIp: 127.0.0.1
condition: selection and not filter
falsepositives:
- Legitimate remote development tools
level: high
Suricata Rule: React Dev Server WebSocket Exploit Attempt
alert tcp any any -> any 3000 (msg:"CVE-2025-62593 React Dev Server WebSocket RCE Attempt"; flow:to_server,established; content:"GET /ws"; http_uri; content:"Upgrade: websocket"; http_header; content:"Origin: http"; http_header; sid:1000001; rev:1;)
Additionally, monitor for Node.js processes spawning cmd.exe or /bin/sh with suspicious arguments. Use EDR telemetry to alert on node or npm creating child processes that execute network commands like curl or wget.
Mitigation and Patching
The primary mitigation is to upgrade react-scripts to version 5.0.2 or later. Run the following command in your project directory:
npm install [email protected]
If you cannot upgrade immediately, apply these compensating controls:
- Bind the dev server to
127.0.0.1instead of0.0.0.0. Inpackage.json, set"start": "react-scripts start --host 127.0.0.1". - Use a firewall to block inbound connections to port 3000 from untrusted networks.
- Disable the dev server when not in use. Do not leave it running in the background.
- Educate developers about the risks of visiting untrusted websites while the dev server is active.
According to the GitHub advisory, the fix involves validating the Origin header in the WebSocket handshake. The patch also adds a warning when the dev server is bound to a non-localhost address.
Why This Matters for Defenders
This vulnerability highlights a persistent blind spot: development tools are often excluded from security reviews and patching cycles. Developers run dev servers with elevated privileges, and these servers frequently listen on all interfaces in containerized or cloud-based development environments. A single malicious website visit can lead to full compromise of a developer workstation, which often holds credentials, source code, and access to production systems.
Security teams should inventory all instances of react-scripts and webpack-dev-server across the organization, enforce network segmentation for development environments, and integrate software composition analysis (SCA) tools into CI/CD pipelines to catch vulnerable dependencies before they reach production. The CISA KEV catalog has not yet added this CVE, but given the widespread use of React, it is likely to be targeted by both opportunistic and sophisticated attackers.
Sources
- GitHub Security Advisory GHSA-2025-62593 — Official advisory detailing the vulnerability, affected versions, and patch.
- npm: react-scripts — Package page showing download statistics and version history.
- CISA Known Exploited Vulnerabilities Catalog — For monitoring active exploitation status.
- NVD Entry for CVE-2025-62593 — CVSS score and vulnerability metrics.
Frequently Asked Questions
Is CVE-2025-62593 exploitable if the dev server is only bound to localhost?
Yes. The attack works by having the victim's browser connect to localhost. Even if the server is bound to 127.0.0.1, a malicious website can still reach it via the browser, because the browser runs on the same machine. The only mitigation is to patch or disable the dev server when not in use.
Does this affect production React applications?
No. Only the development server is vulnerable. Production builds are static files served by a web server and do not include the vulnerable WebSocket endpoint.
What is the CVSS score for CVE-2025-62593?
The CVSS v3.1 base score is 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Are there any known exploits in the wild?
As of November 2025, there are no confirmed reports of active exploitation in the wild. However, a proof-of-concept exploit is publicly available, and given the popularity of React, exploitation attempts are likely.
How can I detect if my organization is affected?
Run npm list react-scripts in your project directories. If the version is below 5.0.2, you are affected. Also check for webpack-dev-server versions below 4.7.3.
What should I do if I cannot patch immediately?
Bind the dev server to 127.0.0.1, block port 3000 at the host firewall, and instruct developers to close the dev server when not actively coding. Consider using a containerized development environment with no network access to the host.
Need expert help with this?
CybernytronX specializes in vulnerability management, penetration testing, and SOC build-out. If you need to assess your exposure to CVE-2025-62593 or integrate detection for development-environment threats, our team can help. We also offer Ethereon AI, our advanced threat detection platform, which can identify anomalous WebSocket activity and suspicious process trees in real time. Contact us at cybernytronx.com/contact or learn more about Ethereon at cybernytronx.com/ethereon.