CVE-2026-117526: reduxjs redux-devtools Remotedev Server evalAction code injection
A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by this vulnerability is the function evalAction of the component Remotedev Server. The manipulation of the argument action results in code injection. The attack is only possible with local access. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Exposure is limited to environments using reduxjs redux-devtools version 5.0.0 with the Remotedev Server component. Exploitation requires local access and at least low-level privileges.
What does an attacker need to exploit it?
An attacker must be able to locally manipulate the action argument passed to the Remotedev Server evalAction function. No user interaction is required, and public exploit material is available.
What is the potential impact of successful exploitation?
Successful exploitation can result in code injection. The reported severity assessment indicates potential low-impact effects on confidentiality, integrity, and availability.
Is a fix available from the project?
The available information does not identify a fixed version or patch. It states that the project was notified through an issue report but had not responded.