« Volver al listado

CVE-2026-39371

Estado: AnalizadaAlta (8.1)—

RedwoodSDK is a server-first React framework. From 1.0.0-beta.50 to 1.0.5, erver functions exported from "use server" files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions, because browsers send SameSite=Lax cookies on top-level GET requests. This affected all server functions -- both serverAction() handlers and bare exported functions in "use server" files. This vulnerability is fixed in 1.0.6.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

XSS via CSRF: navegadores envían cookies SameSite=Lax en GET top-level, permitiendo invocar funciones de servidor que modifican estado sin consentimiento del usuario. CWE-352 (CSRF) confirma vector de ataque basado en navegador.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User TrainingRestrict Web-Based ContentFilter Network TrafficEncrypt Sensitive InformationApplication Isolation and SandboxingExploit Protection

Tecnologías afectadas (1)

Redwoodjs — Redwoodsdk

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-39371",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-39371",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-08T17:46:46.520082Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "redwoodjs",
          "product": "sdk",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.0.0-beta.50, < 1.0.6"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-04-07T20:16:31.980",
  "references": [
    {
      "url": "https://github.com/redwoodjs/sdk/security/advisories/GHSA-x8rx-789c-2pxq",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "RedwoodSDK is a server-first React framework. From 1.0.0-beta.50 to 1.0.5, erver functions exported from \"use server\" files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions, because browsers send SameSite=Lax cookies on top-level GET requests. This affected all server functions -- both serverAction() handlers and bare exported functions in \"use server\" files. This vulnerability is fixed in 1.0.6."
    },
    {
      "lang": "es",
      "value": "RedwoodSDK es un framework React con prioridad en el servidor. Desde la versión 1.0.0-beta.50 hasta la 1.0.5, las funciones del servidor exportadas desde archivos 'use server' podían ser invocadas mediante solicitudes GET, eludiendo su método HTTP previsto. En aplicaciones autenticadas con cookies, esto permitía que las navegaciones GET entre sitios activaran funciones que cambian el estado, porque los navegadores envían cookies SameSite=Lax en solicitudes GET de nivel superior. Esto afectó a todas las funciones del servidor -- tanto a los manejadores serverAction() como a las funciones exportadas directamente en archivos 'use server'. Esta vulnerabilidad está corregida en la versión 1.0.6."
    }
  ],
  "lastModified": "2026-07-24T21:10:00.143",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8E69BB7E-9B98-4DAA-9679-FCC2B9900C71",
              "versionEndExcluding": "1.0.6",
              "versionStartIncluding": "1.0.1"
            },
            {
              "criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta50:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "10DFDEC7-D2A7-4AC5-AA0E-E71B483AB0E1"
            },
            {
              "criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta51:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DD867EAC-3C9A-4292-AC02-2FEF85F180E2"
            },
            {
              "criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta52:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "10E3130A-AD36-4681-B938-CC3A4B996D27"
            },
            {
              "criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta53:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C19C1D4F-E694-4715-B545-426D87630607"
            },
            {
              "criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta53_test20260205213024:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "02ADC1FE-B254-49AC-AAE6-3A2FE05CD8FA"
            },
            {
              "criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta54:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "46F4EA7D-00A2-46BA-9B28-1ED6F6CA810F"
            },
            {
              "criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta55:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CCA20DB6-1D44-468F-8E39-36F3EE4EEA9C"
            },
            {
              "criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta56:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50C28F45-A680-490A-B5D0-DE9D38F0625F"
            },
            {
              "criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta57:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "82672146-941B-42C0-B135-E3300A2418F5"
            },
            {
              "criteria": "cpe:2.3:a:redwoodjs:redwoodsdk:1.0.0:beta58:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1817FEE-0168-4C55-B641-A0CE943CC089"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}