CVE-2023-7079 json
Arbitrary remote file read in Wrangler dev server
published 2023-12-29 2 y ago modified 2026-07-08 4 mo ago also GHSA-cfph-4qqh-w828 , EUVD-2024-0330
- cvss
- 6.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 53%
- public exploits
- 0
- none known
Summary
Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over the local network. An attacker that could trick any user on the local network into opening a malicious website could also read any file.
Patch / fix
- npm wrangler 3.19.0
- Cloudflare wrangler 3.19.0
Exploit prediction
0.70% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.4 | CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N |
| NVD | 3.1 | 5.7 | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 6.9 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | wrangler | >=3.9.0, <3.19.0 |
3.19.0 |
Affected products
- Cloudflare wrangler
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
github.com
/cloudflare/workers-sdk/pull/4532
web, patch
-
github.com
/cloudflare/workers-sdk/pull/4535
web, patch
-
github.com
/cloudflare/workers-sdk/security/advisories/GHSA-cfph-4qqh-w828
web, patch, third-party-advisory
-
github.com
/cloudflare/workers-sdk/commit/29df8e17545bf3926b6d61678b596be809d40c6d
web
-
github.com
/cloudflare/workers-sdk/commit/311ffbd5064f8301ac6f0311bbe5630897923b93
web
-
nvd.nist.gov
/vuln/detail/CVE-2023-7079
advisory
-
github.com
/cloudflare/workers-sdk
package
Sources
- CVE List CVE-2023-7079
- GitHub Advisory GHSA-cfph-4qqh-w828
- NVD CVE-2023-7079
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.