This vulnerability exists in react create-react-app up to version 5.0.1 on macOS, specifically in the startBrowserProcess function of the openBrowser.js file within react-dev-utils. An attacker can manipulate input to cause OS command injection, potentially allowing execution of arbitrary commands on the host system. The vulnerability is remotely exploitable without authentication or user interaction. Although the issue was reported early, the project has not issued a fix or official response. The CVSS 4.0 base score is 6.9, indicating medium severity. No patch or remediation guidance is currently available from the vendor.

Successful exploitation can lead to arbitrary OS command execution on affected systems running vulnerable versions of create-react-app on macOS. This can compromise system integrity and confidentiality. The vulnerability is remotely exploitable without privileges or user interaction, increasing the attack surface. However, the lack of an official fix or mitigation means affected users remain at risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider avoiding use of affected versions (5.0.0 and 5.0.1) on macOS or apply manual mitigations if available. Monitor official react project channels for updates and patches addressing this vulnerability.