https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 11:51:21 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-317422 EUVD-2026-317422 https://cve.radiocsirt.org/vuln/euvd-2026-317422 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42190 <p>RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim&#39;s session cookie attached. This issue has been patched in version 1.2.3.</p> <p>RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim&#39;s session cookie attached. This issue has been patched in version 1.2.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42190 https://cve.radiocsirt.org/vuln/ghsa-m2m6-cff5-3w7c <p><strong>Affected:</strong> npm: rwsdk</p> <p>### Summary</p> <p>Server actions in `rwsdk` apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim&#39;s session cookie attached.</p> <p>### Impact</p> <p>An attacker who controls any origin the browser considers same-site with the deployed app can induce an authenticated victim&#39;s browser to invoke arbitrary server actions. The exposure depends on deployment shape:</p> <p>- Apps deployed on custom domains (for example `app.example.com`) are exposed whenever the attacker controls any sibling subdomain under the same registrable domain. Plausible vectors include subdomain takeover of stale DNS records pointing at third-party services, cross-site scripting on a sibling application, or content served from a user-content subdomain. - Apps deployed on platform-suffix domains on the Public Suffix List (`*.workers.dev`, `*.pages.dev`) are not exposed to the sibling-subdomain vector, because sibling subdomains under those suffixes are treated as cross-site. - In local development, `localhost` on any other port is treated as same-site with the app&#39;s dev server. A separate process running on the developer&#39;s machine can invoke server actions against the dev server.</p> <p>The attacker cannot read action responses (`mode: &#34;no-cors&#34;` yields opaque responses). Impact is therefore limited to side effects of action invocation: writes, state changes, and any externally observable action the applicati…</p> <p><strong>Affected:</strong> npm: rwsdk</p> <p>### Summary</p> <p>Server actions in `rwsdk` apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim&#39;s session cookie attached.</p> <p>### Impact</p> <p>An attacker who controls any origin the browser considers same-site with the deployed app can induce an authenticated victim&#39;s browser to invoke arbitrary server actions. The exposure depends on deployment shape:</p> <p>- Apps deployed on custom domains (for example `app.example.com`) are exposed whenever the attacker controls any sibling subdomain under the same registrable domain. Plausible vectors include subdomain takeover of stale DNS records pointing at third-party services, cross-site scripting on a sibling application, or content served from a user-content subdomain. - Apps deployed on platform-suffix domains on the Public Suffix List (`*.workers.dev`, `*.pages.dev`) are not exposed to the sibling-subdomain vector, because sibling subdomains under those suffixes are treated as cross-site. - In local development, `localhost` on any other port is treated as same-site with the app&#39;s dev server. A separate process running on the developer&#39;s machine can invoke server actions against the dev server.</p> <p>The attacker cannot read action responses (`mode: &#34;no-cors&#34;` yields opaque responses). Impact is therefore limited to side effects of action invocation: writes, state changes, and any externally observable action the applicati…</p> https://cve.radiocsirt.org/vuln/ghsa-m2m6-cff5-3w7c