CVE-2026-42190

{"id": "CVE-2026-42190", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42190", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-12T12:47:18.442327Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "redwoodjs", "product": "sdk", "versions": [{"status": "affected", "version": ">= 1.0.0-beta.50, < 1.2.3"}]}]}], "published": "2026-05-08T20:16:31.580", "references": [{"url": "https://github.com/redwoodjs/sdk/releases/tag/v1.2.3", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/redwoodjs/sdk/security/advisories/GHSA-m2m6-cff5-3w7c", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim's session cookie attached. This issue has been patched in version 1.2.3."}, {"lang": "es", "value": "RedwoodSDK es un framework React con prioridad en el servidor. Desde la versi\u00f3n 1.0.0-beta.50 hasta antes de la versi\u00f3n 1.2.3, las acciones del servidor en rwsdk aplican la aplicaci\u00f3n forzosa del m\u00e9todo HTTP pero no la validaci\u00f3n de origen. Una solicitud originada desde un origen diferente que el navegador trata como del mismo sitio puede invocar una acci\u00f3n del servidor con la cookie de sesi\u00f3n de la v\u00edctima adjunta. Este problema ha sido parcheado en la versi\u00f3n 1.2.3."}], "lastModified": "2026-10-26T00:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3AF1C0CD-80D0-4A93-A6F8-F0E844C54FCB", "versionEndExcluding": "1.2.3", "versionStartIncluding": "1.0.1"}, {"criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta50:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10DFDEC7-D2A7-4AC5-AA0E-E71B483AB0E1"}, {"criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta51:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DD867EAC-3C9A-4292-AC02-2FEF85F180E2"}, {"criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta52:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10E3130A-AD36-4681-B938-CC3A4B996D27"}, {"criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta53:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C19C1D4F-E694-4715-B545-426D87630607"}, {"criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta53_test20260205213024:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02ADC1FE-B254-49AC-AAE6-3A2FE05CD8FA"}, {"criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta54:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "46F4EA7D-00A2-46BA-9B28-1ED6F6CA810F"}, {"criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta55:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CCA20DB6-1D44-468F-8E39-36F3EE4EEA9C"}, {"criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta56:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "50C28F45-A680-490A-B5D0-DE9D38F0625F"}, {"criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta57:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "82672146-941B-42C0-B135-E3300A2418F5"}, {"criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta58:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C1817FEE-0168-4C55-B641-A0CE943CC089"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}