CVE-2023-7079
Arbitrary remote file read in Wrangler dev server
- Published
- Updated
- Reserved
- Assigned by
- cloudflare
Description
Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over the local network. An attacker that could trick any user on the local network into opening a malicious website could also read any file.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| cloudflareCNA (assigner) | 3.1 | Medium6.4 | CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N |
| NVDNVD · Modified | 3.1 | Medium5.7 | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.70% · top 47% of all CVEs (6 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.4.
Weakness
Affected products
- affected ≤ 3.9.0
- affected < 3.19.0
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- npmwranglerGHSA-cfph-4qqh-w828 (opens in a new tab)
What to do
Workaround: Configure Wrangler to listen on local interfaces instead with wrangler dev --ip 127.0.0.1. This is the default as of [email protected] https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-f8mp-x433-5wpf , and removes the local network as an attack vector, but does not prevent an attack from visiting a malicious website.
References (3)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-cfph-4qqh-w828 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-7079)Record last updated .