CVE-2026-42190

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42190", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-25T01:53:21.583Z", "datePublished": "2026-05-08T19:35:17.905Z", "dateUpdated": "2026-05-12T18:32:06.047Z"}, "containers": {"cna": {"title": "RedwoodSDK: Same-site CSRF in in server actions", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/redwoodjs/sdk/security/advisories/GHSA-m2m6-cff5-3w7c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/redwoodjs/sdk/security/advisories/GHSA-m2m6-cff5-3w7c"}, {"name": "https://github.com/redwoodjs/sdk/releases/tag/v1.2.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/redwoodjs/sdk/releases/tag/v1.2.3"}], "affected": [{"vendor": "redwoodjs", "product": "sdk", "versions": [{"version": ">= 1.0.0-beta.50, < 1.2.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T19:35:17.905Z"}, "descriptions": [{"lang": "en", "value": "RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim's session cookie attached. This issue has been patched in version 1.2.3."}], "source": {"advisory": "GHSA-m2m6-cff5-3w7c", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-12T12:47:18.442327Z", "id": "CVE-2026-42190", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-12T18:32:06.047Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42190", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-12T12:47:18.442327Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-12T12:50:39.583Z"}}], "cna": {"title": "RedwoodSDK: Same-site CSRF in in server actions", "source": {"advisory": "GHSA-m2m6-cff5-3w7c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "redwoodjs", "product": "sdk", "versions": [{"status": "affected", "version": ">= 1.0.0-beta.50, < 1.2.3"}]}], "references": [{"url": "https://github.com/redwoodjs/sdk/security/advisories/GHSA-m2m6-cff5-3w7c", "name": "https://github.com/redwoodjs/sdk/security/advisories/GHSA-m2m6-cff5-3w7c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/redwoodjs/sdk/releases/tag/v1.2.3", "name": "https://github.com/redwoodjs/sdk/releases/tag/v1.2.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim's session cookie attached. This issue has been patched in version 1.2.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T19:35:17.905Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42190", "state": "PUBLISHED", "dateUpdated": "2026-05-12T18:32:06.047Z", "dateReserved": "2026-04-25T01:53:21.583Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-08T19:35:17.905Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "sdk", "vendor": "redwoodjs", "versions": [{"status": "affected", "version": ">= 1.0.0-beta.50, < 1.2.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:*:*:*:*:*:*:*:*", "matchCriteriaId": "3AF1C0CD-80D0-4A93-A6F8-F0E844C54FCB", "versionEndExcluding": "1.2.3", "versionStartIncluding": "1.0.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta50:*:*:*:*:*:*", "matchCriteriaId": "10DFDEC7-D2A7-4AC5-AA0E-E71B483AB0E1", "vulnerable": true}, {"criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta51:*:*:*:*:*:*", "matchCriteriaId": "DD867EAC-3C9A-4292-AC02-2FEF85F180E2", "vulnerable": true}, {"criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta52:*:*:*:*:*:*", "matchCriteriaId": "10E3130A-AD36-4681-B938-CC3A4B996D27", "vulnerable": true}, {"criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta53:*:*:*:*:*:*", "matchCriteriaId": "C19C1D4F-E694-4715-B545-426D87630607", "vulnerable": true}, {"criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta53_test20260205213024:*:*:*:*:*:*", "matchCriteriaId": "02ADC1FE-B254-49AC-AAE6-3A2FE05CD8FA", "vulnerable": true}, {"criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta54:*:*:*:*:*:*", "matchCriteriaId": "46F4EA7D-00A2-46BA-9B28-1ED6F6CA810F", "vulnerable": true}, {"criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta55:*:*:*:*:*:*", "matchCriteriaId": "CCA20DB6-1D44-468F-8E39-36F3EE4EEA9C", "vulnerable": true}, {"criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta56:*:*:*:*:*:*", "matchCriteriaId": "50C28F45-A680-490A-B5D0-DE9D38F0625F", "vulnerable": true}, {"criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta57:*:*:*:*:*:*", "matchCriteriaId": "82672146-941B-42C0-B135-E3300A2418F5", "vulnerable": true}, {"criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta58:*:*:*:*:*:*", "matchCriteriaId": "C1817FEE-0168-4C55-B641-A0CE943CC089", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim's session cookie attached. This issue has been patched in version 1.2.3."}, {"lang": "es", "value": "RedwoodSDK es un framework React con prioridad en el servidor. Desde la versi\u00f3n 1.0.0-beta.50 hasta antes de la versi\u00f3n 1.2.3, las acciones del servidor en rwsdk aplican la aplicaci\u00f3n forzosa del m\u00e9todo HTTP pero no la validaci\u00f3n de origen. Una solicitud originada desde un origen diferente que el navegador trata como del mismo sitio puede invocar una acci\u00f3n del servidor con la cookie de sesi\u00f3n de la v\u00edctima adjunta. Este problema ha sido parcheado en la versi\u00f3n 1.2.3."}], "id": "CVE-2026-42190", "lastModified": "2026-10-26T00:10:00.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42190", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-12T12:47:18.442327Z", "version": "2.0.3"}}]}, "published": "2026-05-08T20:16:31.580", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/redwoodjs/sdk/releases/tag/v1.2.3"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/redwoodjs/sdk/security/advisories/GHSA-m2m6-cff5-3w7c"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0-beta.50,1.2.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "sdk", "source": "cna", "vendor": "redwoodjs"}, "product": "sdk", "vendor": "redwoodjs"}], "created": "2026-05-08T21:30:05.620800+00:00", "updated": "2026-05-08T22:30:18.070575+00:00", "vendors": ["redwoodjs", "redwoodjs$PRODUCT$sdk"]}