Arbitrary remote code execution within `wrangler dev` Workers sandbox

The vulnerability stems from the Wrangler development server's V8 inspector, which is intentionally designed to allow debugging by enabling arbitrary code execution within a sandboxed environment. However, the inspector server in earlier versions of Wrangler did not properly validate Origin and Host headers. This oversight allows an attacker on the local network to connect to the inspector and execute arbitrary code. A particularly concerning aspect is the potential for attackers to trick users into visiting a malicious website, granting them the ability to run code. If wrangler dev --remote is used, the attacker could potentially access production resources, significantly expanding the blast radius of the attack. This vulnerability presents a high risk of unauthorized code execution and potential data compromise.

Developers using Wrangler for local Cloudflare Workers development are at risk, particularly those who have enabled the --remote flag or are running the development server on networks with untrusted devices. Shared hosting environments where multiple developers share the same machine and Wrangler is installed could also be vulnerable.

• nodejs / supply-chain:

Get-Process -Name wrangler | Select-Object Id, ProcessName, CPU, WorkingSet

• nodejs / supply-chain:

Get-ScheduledTask | Where-Object {$_.TaskName -like '*wrangler*'} | Select-Object TaskName, State, LastRunTime

• generic web: Use curl or wget to check if the inspector endpoint is exposed. A successful connection indicates potential vulnerability.

curl http://localhost:8787/debug

1. 2024-01-03Disclosure

   disclosure

1. आरक्षित2023-12-22
2. प्रकाशित2024-01-03
3. संशोधित2026-02-04
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2023-7080 is to upgrade to Wrangler version 3.19.0 or later, which includes the necessary fixes to properly validate Origin and Host headers. If an immediate upgrade is not feasible, consider temporarily disabling the inspector server by running wrangler dev --no-inspector. Additionally, restrict network access to the development server by only allowing connections from trusted sources. Monitor network traffic for suspicious connections to the inspector port. After upgrading, confirm the fix by attempting to connect to the inspector from a remote machine and verifying that the connection is denied.