Arbitrary remote file read in Wrangler dev server
Priority LOW 30CWE-287Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.
Summary
Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over the local network. An attacker that could trick any user on the local network into opening a malicious website could also read any file.
Why it matters now
EPSS 0.00699 53rd percentileScored 2026-11-07
Fix Fixed wrangler (Cloudflare): 3.19.0wrangler (npm): 3.19.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cloudflare | wrangler | up to 3.9.0; before 3.19.0 | 3.19.0 | Patch available | CNA |
| — | wrangler (npm) | 3.9.0 to before 3.19.0 | 3.19.0 | Patch available | GHSA-cfph-4qqh-w828 |
- wrangler VendorCloudflare Affected up to 3.9.0; before 3.19.0 Fixed in 3.19.0 Patch available CNA
- wrangler (npm) Vendor— Affected 3.9.0 to before 3.19.0 Fixed in 3.19.0 Patch available GHSA-cfph-4qqh-w828
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cloudflare:wrangler:*:*:*:*:*:node.js:*:* | 3.9.0 to before 3.19.0 | Vulnerable | Cloudflare |
- cpe:2.3:a:cloudflare:wrangler:*:*:*:*:*:node.js:*:* Versions 3.9.0 to before 3.19.0 Vulnerable ·Cloudflare
Remediation
- Fix · CNA wrangler (Cloudflare) Fixed in 3.19.0
- Fix · GHSA-cfph-4qqh-w828 wrangler (npm) Fixed in 3.19.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-7079
- 2026-10-03 Alias added: GHSA-cfph-4qqh-w828
References
Patch 3
More Cloudflare Wrangler vulnerabilities
- TI-2026-00705 OS Command Injection in `wrangler pages deploy` CVSS 4.0HIGH 7.7
- TI-2023-06476 Arbitrary remote code execution within wrangler dev Workers sandbox CVSS 3.1HIGH 8.5
- TI-2023-03133 Directory traversal vulnerability in Cloudflare Wrangler CVSS 3.1MEDIUM 5.7
Sources
- CVE-2023-7079 · CVE Program
- CVE-2023-7079 · NVD
- FIRST EPSS
- GHSA-cfph-4qqh-w828 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences