CVE-2023-7079
Arbitrary remote file read in Wrangler dev server
Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over the local network. An attacker that could trick any user on the local network into opening a malicious website could also read any file.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Arbitrary remote file read in Wrangler dev server
Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over the local network. An attacker that could trick any user on the local network into opening a malicious website could also read any file.
- Record
CVE-2023-7079- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
EUVDEUVD-2024-0330
Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over the local network. An attacker that could trick any user on the local network into opening a malicious website could also read any file.
- Record
EUVD-2024-0330- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cfph-4qqh-w828
Arbitrary remote file read in Wrangler dev server
Impact
Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over the local network. An attacker that could trick any user on the local network into opening a malicious website could also read any file.
Patches
This issue was fixed in [email protected]. Wrangler will now only serve files that are part of your bundle, or referenced by your bundle's source maps.
Workarounds
Configure Wrangler to listen on local interfaces instead with wrangler dev --ip 127.0.0.1. This is the default as of [email protected], and removes the local network as an attack vector, but does not prevent an attack from visiting a malicious website.
References
- Record
GHSA-cfph-4qqh-w828- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
NVD
Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over the local network. An attacker that could trick any user on the local network into opening a malicious website could also read any file.
- Record
CVE-2023-7079- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N - CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
Arbitrary remote file read in Wrangler dev server
Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over the local network. An attacker that could trick any user on the local network into opening a malicious website could also read any file.
- Record
CVE-2023-7079- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVGHSA-cfph-4qqh-w828
Arbitrary remote file read in Wrangler dev server
Impact
Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer being accessible over the local network. An attacker that could trick any user on the local network into opening a malicious website could also read any file.
Patches
This issue was fixed in [email protected]. Wrangler will now only serve files that are part of your bundle, or referenced by your bundle's source maps.
Workarounds
Configure Wrangler to listen on local interfaces instead with wrangler dev --ip 127.0.0.1. This is the default as of [email protected], and removes the local network as an attack vector, but does not prevent an attack from visiting a malicious website.
References
- Record
GHSA-cfph-4qqh-w828- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wranglernpm |
3.9.0 up to 3.19.0 | 3.19.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-7079 is a medium vulnerability (CVSS 6.4) in Cloudflare Wrangler, published December 29, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.70%, the 53rd percentile. Fixed in wrangler 3.19.0.
References
github.com/cloudflare/workers-sdk/security/advisories/GHSA-cfph-4qqh-w828
nvd.nist.gov/vuln/detail/CVE-2023-7079