CVE-2026-97366 in react-native-debugger
Summary
by MITRE • 09/24/2026
A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of the file electron/window.js of the component Open in Editor Handler. The manipulation of the argument host results in os command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in jhen0409 react-native-debugger versions up to 0.14.0 represents a critical security failure within the application's developer tools integration layer. Specifically, the flaw resides in the openDevTools function located in the electron/window.js file, which is part of the Open in Editor Handler component. This component is responsible for managing interactions between the debugger interface and external development environments or system utilities. The core technical issue stems from improper input validation when processing the host argument passed to this function. Instead of sanitizing or strictly validating the hostname parameter before its use in underlying system calls, the application allows arbitrary command strings to be injected into the execution context. This lack of rigorous boundary checking creates a direct pathway for an attacker to manipulate how the operating system interprets and executes commands initiated by the debugger tool.
From a technical perspective, this flaw constitutes a classic OS Command Injection vulnerability, aligning with CWE-78 in the Common Weakness Enumeration taxonomy. The severity is exacerbated by the fact that the manipulation of the host argument can be triggered remotely. In many development workflows involving react-native-debugger, connections to remote hosts or debug targets are common practices. If an attacker controls or influences the target host address used during a debugging session, they can inject malicious payloads into the command string executed by the electron process. Because Electron applications typically run with elevated privileges relative to standard web browsers and often have access to local file systems and network interfaces, successful exploitation allows for arbitrary code execution on the victim's machine under the context of the user running the debugger application.
The operational impact of this vulnerability is severe, enabling remote attackers to achieve full control over the affected system without requiring prior authentication or physical access. Once exploited, an attacker can execute any command permitted by the privileges of the current user. This could lead to data exfiltration, installation of persistent backdoors, pivoting into internal networks if the debugger has network access, or complete compromise of the development environment. The fact that a public exploit exists significantly lowers the barrier for entry, allowing less sophisticated threat actors to leverage this flaw in automated attacks against developers who use vulnerable versions of react-native-debugger. This situation highlights a critical risk vector in software supply chains where developer tools are often trusted implicitly but may contain severe security defects due to insufficient secure coding practices during development.
The vendor's lack of response to early disclosure attempts further compounds the risk, leaving users without official patches or guidance for an extended period. In such scenarios, mitigation strategies must be implemented by the end-users and organizations relying on this tool. The most effective immediate remediation is to upgrade to a patched version if one becomes available in future releases. However, given the vendor's unresponsiveness, alternative measures are necessary. Users should consider disabling or removing the Open in Editor Handler functionality if it is not strictly required for their workflow. Additionally, implementing strict network segmentation and applying application whitelisting can help mitigate the impact of successful exploitation by restricting what processes can execute commands on the system. Security teams should also monitor for unusual process creation events originating from electron-based applications as part of their endpoint detection and response strategies to identify potential active exploitation attempts in real time.