Redwoodjs RedwoodSDK 1.0.0 Beta 58
Approved changes feed: RSS · Atom
cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta58:*:*:*:*:*:*
part: a version: 1.0.0 update: beta58
| Vendor | Redwoodjs (86c2f7ce-f45d-5f62-9899-4a5688363b79) |
|---|---|
| Product | Redwoodsdk (739e8711-54d8-5e30-a924-0b160dd936f3) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/redwoodjs/sdk |
purl2cpe | 2026-07-28 16:40:51.738868 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-42190 |
vulnerable | 2026-06-08 08:03:16.004491 |
RedwoodSDK: Same-site CSRF in in server actions
MEDIUM (5.3)
RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim's session cookie attached. This issue has been patched in version 1.2.3.
Published: 2026-05-08T19:35:17.905Z
Updated: 2026-05-12T18:32:06.047Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-39371 |
vulnerable | 2026-06-08 08:01:16.395452 |
RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests
HIGH (8.1)
RedwoodSDK is a server-first React framework. From 1.0.0-beta.50 to 1.0.5, erver functions exported from "use server" files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions, because browsers send SameSite=Lax cookies on top-level GET requests. This affected all server functions -- both serverAction() handlers and bare exported functions in "use server" files. This vulnerability is fixed in 1.0.6.
Published: 2026-04-07T19:28:30.941Z
Updated: 2026-04-08T17:46:55.661Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.