CVE-2026-42190

MEDIUM EPSS 1.6%
Published May 8, 20261mo ago · Modified Jun 17, 20262w ago
5.3 CVSS 3.1
Medium
Find Similar
Published May 8, 2026 1mo ago
Last Modified Jun 17, 2026 2w ago

Description

RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim's session cookie attached. This issue has been patched in version 1.2.3.

CVSS Details

Base Score
5.3
Exploitability
1.6
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality None
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
1.6% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-352 Cross-Site Request Forgery (CSRF) Authentication

Affected Products 11

VendorProductVersionRange
redwoodjsredwoodsdk*≥1.0.1  –  <1.2.3
redwoodjsredwoodsdk1.0.0any
redwoodjsredwoodsdk1.0.0any
redwoodjsredwoodsdk1.0.0any
redwoodjsredwoodsdk1.0.0any
redwoodjsredwoodsdk1.0.0any
redwoodjsredwoodsdk1.0.0any
redwoodjsredwoodsdk1.0.0any
redwoodjsredwoodsdk1.0.0any
redwoodjsredwoodsdk1.0.0any
redwoodjsredwoodsdk1.0.0any

References 2

  • github.com https://github.com/redwoodjs/sdk/releases/tag/v1.2.3
    ProductRelease Notes
  • github.com https://github.com/redwoodjs/sdk/security/advisories/GHSA-m2m6-cff5-3w7c
    Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.