CVE-2026-97366 jhen0409 CVE debrief

Who should care

Defenders responsible for jhen0409 react-native-debugger deployments should assess exposure to remote attacks and verify the presence of affected versions in their inventory. They should also implement compensating controls to prevent exploitation and review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

CVE-2026-97366 is a security flaw in jhen0409 react-native-debugger up to 0.14.0 that allows remote os command injection. Defenders should prioritize verifying the presence of affected versions in their inventory and assessing exposure to remote attacks.

• Verify the presence of affected versions in inventory
• Assess exposure to remote attacks
• Implement compensating controls to prevent exploitation

Technical summary

The function openDevTools of the file electron/window.js of the component Open in Editor Handler in jhen0409 react-native-debugger up to 0.14.0 is vulnerable to os command injection. The manipulation of the argument host results in os command injection. It is possible to launch the attack remotely. This vulnerability allows remote attackers to execute arbitrary commands on the affected system, potentially leading to unauthorized access or data breaches. Defenders should prioritize verifying the presence of affected versions in their inventory and assessing exposure to remote attacks.

Defensive priority

Defenders should prioritize verifying the presence of affected versions in their inventory and assessing exposure to remote attacks.

Recommended defensive actions

• Verify the presence of affected versions in inventory
• Assess exposure to remote attacks
• Implement compensating controls to prevent exploitation
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the vendor did not respond to the disclosure. The exploit has been released to the public. Defenders should verify the presence of affected versions in their inventory and assess exposure to remote attacks. The impacted element is the function openDevTools of the file electron/window.js of the component Open in Editor Handler in jhen0409 react-native-debugger up to 0.14.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.