CVE-2023-7080: RCE in Wrangler Node.js Dev Server

The vulnerability stems from the Wrangler development server's V8 inspector, which is intentionally designed to allow debugging by enabling arbitrary code execution within a sandboxed environment. However, the inspector server in earlier versions of Wrangler did not properly validate Origin and Host headers. This oversight allows an attacker on the local network to connect to the inspector and execute arbitrary code. A particularly concerning aspect is the potential for attackers to trick users into visiting a malicious website, granting them the ability to run code. If wrangler dev --remote is used, the attacker could potentially access production resources, significantly expanding the blast radius of the attack. This vulnerability presents a high risk of unauthorized code execution and potential data compromise.

1. Reserved2023-12-22
2. Published2024-01-03
3. Modified2026-02-04
4. EPSS updated2026-04-02

The primary mitigation for CVE-2023-7080 is to upgrade to Wrangler version 3.19.0 or later, which includes the necessary fixes to properly validate Origin and Host headers. If an immediate upgrade is not feasible, consider temporarily disabling the inspector server by running wrangler dev --no-inspector. Additionally, restrict network access to the development server by only allowing connections from trusted sources. Monitor network traffic for suspicious connections to the inspector port. After upgrading, confirm the fix by attempting to connect to the inspector from a remote machine and verifying that the connection is denied.