Description
A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by this vulnerability is the function evalAction of the component Remotedev Server. The manipulation of the argument action results in code injection. The attack is only possible with local access. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-27
Score: 4.8 Medium
EPSS: n/a
KEV: No
Impact: Local Code Execution
Action: Apply Patch
AI Analysis

Impact

A vulnerability exists in the evalAction function of the Remotedev Server component. By manipulating the action argument, an attacker able to supply crafted input can cause the server to evaluate arbitrary JavaScript, leading to code injection. The primary impact is local code execution; an attacker who can directly interact with the server will be able to run arbitrary code on the host machine. This represents a CWE‑74 flaw in input handling combined with a CWE‑94 fault in dynamic code execution.

Affected Systems

The issue affects reduxjs redux-devtools, specifically version 5.0.0. Users running this version of the development tools and running the Remotedev Server are vulnerable. No other versions were included in the official impact list.

Risk and Exploitability

The CVSS score of 4.8 indicates a moderate overall risk. The EPSS value is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attack is only possible with local access, which limits exposure to systems where an adversary has existing local privileges or can inject data into the Remotedev Server. While exploitation requires local interaction, the ability to execute arbitrary code on a developer workstation or CI environment is still significant, especially for teams running the server unfiltered.

Generated by OpenCVE AI on October 27, 2026 at 19:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade redux-devtools to a version where the evalAction vulnerability is fixed, if earlier than 5.0.0.
  • If an update is not yet available, remove or disable the Remotedev Server component from the development environment until a patch is released.
  • Restrict who can start or access the Remotedev Server locally by applying strict user permissions or firewall rules to limit exploitation surface.
  • Monitor the project's issue tracker for a fix and apply any vendor‑provided hot‑fix when released.

Generated by OpenCVE AI on October 27, 2026 at 19:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by this vulnerability is the function evalAction of the component Remotedev Server. The manipulation of the argument action results in code injection. The attack is only possible with local access. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Title reduxjs redux-devtools Remotedev Server evalAction code injection
First Time appeared Reduxjs
Reduxjs redux-devtools
Weaknesses CWE-74
CWE-94
CPEs cpe:2.3:a:reduxjs:redux-devtools:*:*:*:*:*:*:*:*
Vendors & Products Reduxjs
Reduxjs redux-devtools
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Reduxjs Redux-devtools
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-27T17:45:15.061Z

Reserved: 2026-10-27T09:43:09.716Z

Link: CVE-2026-117526

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-27T18:17:36.520

Modified: 2026-10-27T18:17:36.520

Link: CVE-2026-117526

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T19:30:09Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')