{"id":"CVE-2026-117526","kind":"vulnerability","aliases":["CVE-2026-117526"],"related":[],"title":"redux-devtools: Remotedev server evalAction lets local input inject code","description":"A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by this vulnerability is the function evalAction of the component Remotedev Server. The manipulation of the argument action results in code injection. The attack is only possible with local access. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"redux-devtools 5.0.0 has a flaw in the Remotedev Server function evalAction where a crafted action argument is evaluated as code. A local user who can send actions to the server can run code as the server process.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["developer-tooling","node","package","redux","redux-devtools"],"not_affected_if":["browser-extension-only","no-remotedev-server"],"how_to_check":"- Check the installed version with `npm ls redux-devtools` or `npm ls @redux-devtools/remote`\n- Confirm whether a Remotedev Server is running from the project with `ps aux | grep -i remotedev`","fix":null,"status":"open","published_at":"2026-10-27T18:17:36+00:00","first_seen_at":"2026-10-27T18:32:59+00:00","triaged_at":"2026-10-27T18:34:56+00:00","updated_at":"2026-10-27T18:34:56+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T18:34:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"redux-devtools: Remotedev server evalAction lets local input inject code","impact":"high","summary":"redux-devtools 5.0.0 has a flaw in the Remotedev Server function evalAction where a crafted action argument is evaluated as code. A local user who can send actions to the server can run code as the server process.","category":"package","nicknames":[],"who_cares":["redux","redux-devtools","node","developer-tooling"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code as the Remotedev server process user","analyst_note":"Find the patched version or upstream fix in the NVD entry or the project repository, and confirm whether the browser extension is also affected.","how_to_check":"- Check the installed version with `npm ls redux-devtools` or `npm ls @redux-devtools/remote`\n- Confirm whether a Remotedev Server is running from the project with `ps aux | grep -i remotedev`","needs_analyst":true,"not_affected_if":["no-remotedev-server","browser-extension-only"],"who_is_affected":"Teams running the redux-devtools 5.0.0 Remotedev Server locally for debugging. The sources describe only local access as the attack path, and do not say whether a production build or a browser-only setup is affected. Teams that do not run the Remotedev Server can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000587,"input_tokens":3324,"output_tokens":509,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-117526':14A,17A '-2026':13A,16A '5.0.0':30B,75C 'access':106C 'action':43B,55B,94C 'affect':76C 'argument':44B,93C 'attack':100C 'code':11A,48B,61B,97C 'compon':86C 'could':114C 'craft':42B 'cve':12A,15A 'develop':19B 'developer-tool':18B 'devtool':3A,26B,29B,74C 'earli':124C 'evalact':6A,39B,83C 'evalu':46B 'exploit':108C 'flaw':33B 'found':69C 'function':38B,82C 'inform':120C 'inject':10A,98C 'input':9A 'issu':127C 'let':7A 'local':8A,50B,105C 'made':111C 'manipul':90C 'node':21B 'packag':22B 'possibl':103C 'problem':123C 'process':65B 'project':118C 'public':112C 'redux':2A,23B,25B,28B,73C 'redux-devtool':1A,24B,27B,72C 'reduxj':71C 'remotedev':4A,36B,87C 'report':128C 'respond':132C 'result':95C 'run':60B 'send':54B 'server':5A,37B,58B,64B,88C 'tool':20B 'use':116C 'user':51B 'vulner':67C,79C 'yet':133C","nicknames":[],"mitigations":[],"who_affected":"Teams running the redux-devtools 5.0.0 Remotedev Server locally for debugging. The sources describe only local access as the attack path, and do not say whether a production build or a browser-only setup is affected. Teams that do not run the Remotedev Server can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T18:17:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117526","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117526","severity":null,"published_at":"2026-10-27T18:17:36+00:00","modified_at":"2026-10-27T18:17:36+00:00","first_seen_at":"2026-10-27T18:32:59+00:00","fetched_at":"2026-10-27T18:32:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}