The vulnerability CVE-2026-14802 exists in react create-react-app up to version 5.0.1 on macOS, specifically in the startBrowserProcess function of openBrowser.js within react-dev-utils. It allows OS command injection through manipulation of this function, enabling remote attackers to execute arbitrary commands on the host system. The vulnerability was responsibly disclosed early to the project maintainers, but as of the publication date, no official fix or remediation has been released. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, with low to limited impact on confidentiality, integrity, and availability. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary operating system commands on affected systems running react create-react-app versions 5.0.0 and 5.0.1 on macOS. This can lead to unauthorized system access, data compromise, or further attacks depending on the commands executed. The impact is rated medium severity with a CVSS score of 6.9, reflecting the potential for significant but not critical harm.

As of the current information, no official fix or patch is available from the vendor. Users should monitor the official react project advisories for updates and apply patches once released. Until a fix is available, avoid using affected versions (5.0.0 and 5.0.1) on macOS in untrusted environments or restrict network exposure to reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.