Based on the description, it is inferred that the attacker can inject arbitrary shell commands into the startBrowserProcess function of the react-dev-utils package when it launches a browser on macOS. By supplying crafted input, the node process can execute those commands with the privileges of the user running the development server, allowing remote code execution without local privilege escalation. The weakness is identified as command injection (CWE‑77) and insecure operating system command execution (CWE‑78).

The vulnerability affects the React create‑react‑app package up to version 5.0.1 on macOS. Any installation of that package that has not been upgraded to a newer release is potentially vulnerable. The flaw resides in the openBrowser.js component of react‑dev‑utils, part of the create‑react‑app toolchain.

Based on the description, it is inferred that the attacker can deliver malicious input by exploiting the automatic browser launch in a remote development environment, making the attack vector remote. The CVSS score of 6.9 indicates moderate severity. The EPSS score of 1% suggests a low but non‑zero likelihood of exploitation, yet the existence of public exploits raises the practical risk. The vulnerability is not listed in CISA KEV, but it can be leveraged from a remote development environment that automatically opens a browser when the local server starts, making the attack vector likely remote on a developer machine.