webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state‑changing actions on any GET request without verifying that the request originated from the dev server’s own page. Because the implementation lacks proper CSRF protection (CWE‑352), HTTP method validation (CWE‑749), and includes a vulnerability identified as CWE‑940, any website a developer visits while the dev server is running can trigger these endpoints cross‑origin with only a visit. An attacker can open an arbitrary existing local file in the developer’s editor—including files outside the project root—and repeated requests can spawn editor processes, force recompilations, and degrade the developer’s machine.

The vulnerability affects the webpack‑dev‑server product. Affected versions include 5.2.5 and all earlier releases.

The CVSS base score is 4.7, indicating a moderate severity. The EPSS score of <1% indicates a very low but non‑zero probability that this vulnerability will be exploited. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a cross‑origin request from any website visited while the dev server is running; the attacker does not need to deliver any payload or perform user interaction beyond visiting the site. Successful exploitation grants the attacker the ability to execute editor processes on the developer’s machine and read arbitrary files, which could lead to further local compromise.