---
id: "CVE-2026-117526"
kind: "vulnerability"
aliases: ["CVE-2026-117526"]
title: "redux-devtools: Remotedev server evalAction lets local input inject code"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["developer-tooling", "node", "package", "redux", "redux-devtools"]
not_affected_if: ["browser-extension-only", "no-remotedev-server"]
published_at: "2026-10-27T18:17:36+00:00"
first_seen_at: "2026-10-27T18:32:59+00:00"
updated_at: "2026-10-27T18:34:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117526", "first_seen_at": "2026-10-27T18:32:59+00:00"}]
---

# redux-devtools: Remotedev server evalAction lets local input inject code

redux-devtools 5.0.0 has a flaw in the Remotedev Server function evalAction where a crafted action argument is evaluated as code. A local user who can send actions to the server can run code as the server process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `npm ls redux-devtools` or `npm ls @redux-devtools/remote`
- Confirm whether a Remotedev Server is running from the project with `ps aux | grep -i remotedev`

## Timeline

- 2026-10-27T18:32:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117526

## From the sources

A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by this vulnerability is the function evalAction of the component Remotedev Server. The manipulation of the argument action results in code injection. The attack is only possible with local access. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_