Log in Start free

Vulnerability · Published Oct 27, 2026 · Assigned by VulDB

CVE-2026-117526reduxjs redux-devtools Remotedev Server evalAction code injection

Medium 5.3

In plain English

A medium-severity code injection in redux-devtools from reduxjs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.1%top 96.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by this vulnerability is the function evalAction of the component Remotedev Server. The manipulation of the argument action results in code injection. The attack is only possible with local access. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13node-redux-devtoolsno fix listedDEBIAN-CVE-2026-117526
Debian:14node-redux-devtoolsno fix listedDEBIAN-CVE-2026-117526
Ubuntu:24.04:LTSnode-redux-devtoolsno fix listedUBUNTU-CVE-2026-117526
Ubuntu:26.04:LTSnode-redux-devtoolsno fix listedUBUNTU-CVE-2026-117526
Ubuntu:26.10node-redux-devtoolsno fix listedUBUNTU-CVE-2026-117526

Affected products (as reported)

VendorProductVersions
reduxjs redux-devtools 5.0.0

Weakness: CWE-94, CWE-74 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

References