Threats affecting pkg:npm/jhen0409/react-native-debugger

CVE-2026-97366 is an OS command injection vulnerability in the react-native-debugger project by jhen0409, affecting versions 0.1 through 0.14.0. The flaw exists in the openDevTools function within electron/window.js, specifically in the Open in Editor Handler component. Manipulating the host argument allows remote attackers to execute arbitrary OS commands. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3. Public exploit code is available, but the vendor has not responded or issued a fix.