JFrog discloses CVSS 9.8 React vulnerability putting millions of developers at risk

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical React Vulnerability Discovered by JFrog Threatens Software Supply Chains JFrog has identified a critical vulnerability in React, rated CVSS 9.8, which allows unauthenticated attackers to execute arbitrary operating system commands on affected machines. This vulnerability poses a significant risk to millions of developers utilizing the React framework in their software supply chains. 2 sources 49