https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 18:30:46 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-363602 EUVD-2026-363602 https://cve.radiocsirt.org/vuln/euvd-2026-363602 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49455 <p>Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku&#39;s RSC request dispatcher invokes server actions without validating the request&#39;s Origin (or Sec-Fetch-Site) header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registered server action endpoint using a CORS-safelisted content type (text/plain), which does not trigger a preflight. Any state-mutating server action that the application exposes via &#39;use server&#39; can be invoked with the victim&#39;s cookies attached. This issue has been patched in version 1.0.0-beta.1.</p> <p>Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku&#39;s RSC request dispatcher invokes server actions without validating the request&#39;s Origin (or Sec-Fetch-Site) header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registered server action endpoint using a CORS-safelisted content type (text/plain), which does not trigger a preflight. Any state-mutating server action that the application exposes via &#39;use server&#39; can be invoked with the victim&#39;s cookies attached. This issue has been patched in version 1.0.0-beta.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-49455 https://cve.radiocsirt.org/vuln/ghsa-75w3-gmqx-993q <p><strong>Affected:</strong> npm: waku</p> <p>## Summary</p> <p>Waku&#39;s RSC request dispatcher invokes server actions without validating the request&#39;s `Origin` (or `Sec-Fetch-Site`) header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated `POST` to a registered server action endpoint using a CORS-safelisted content type (`text/plain`), which does not trigger a preflight. Any state-mutating server action that the application exposes via `&#39;use server&#39;` can be invoked with the victim&#39;s cookies attached. A working proof-of-concept demonstrates the vulnerability against waku 1.0.0-beta.0 dev server: a cross-origin POST with `Content-Type: text/plain` invokes a registered `&#39;use server&#39;` action and returns HTTP 200 with an RSC stream response. The same defect affects the progressive-enhancement (no-JavaScript) server action path: a cross-origin HTML form auto-submitting `multipart/form-data` reaches the dispatch through a second unguarded branch of the request handler, dynamically confirmed on 2026-05-17. Both branches were confirmed exploitable from opaque-origin contexts (sandboxed iframes, `file://` navigation, browser extension pages), which send `Origin: null` — a value no Origin guard exists to reject. This is the same vulnerability class previously disclosed for Next.js Server Actions (GHSA-mq59-m269-xvcx); waku&#39;s implementation is broader in that no Origin check exists at all in the default request handler.</p> <p>## Root cause</p> <p>In `packages/waku/src/lib/utils/request.ts`:</p> <p>```ts // line 2…</p> <p><strong>Affected:</strong> npm: waku</p> <p>## Summary</p> <p>Waku&#39;s RSC request dispatcher invokes server actions without validating the request&#39;s `Origin` (or `Sec-Fetch-Site`) header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated `POST` to a registered server action endpoint using a CORS-safelisted content type (`text/plain`), which does not trigger a preflight. Any state-mutating server action that the application exposes via `&#39;use server&#39;` can be invoked with the victim&#39;s cookies attached. A working proof-of-concept demonstrates the vulnerability against waku 1.0.0-beta.0 dev server: a cross-origin POST with `Content-Type: text/plain` invokes a registered `&#39;use server&#39;` action and returns HTTP 200 with an RSC stream response. The same defect affects the progressive-enhancement (no-JavaScript) server action path: a cross-origin HTML form auto-submitting `multipart/form-data` reaches the dispatch through a second unguarded branch of the request handler, dynamically confirmed on 2026-05-17. Both branches were confirmed exploitable from opaque-origin contexts (sandboxed iframes, `file://` navigation, browser extension pages), which send `Origin: null` — a value no Origin guard exists to reject. This is the same vulnerability class previously disclosed for Next.js Server Actions (GHSA-mq59-m269-xvcx); waku&#39;s implementation is broader in that no Origin check exists at all in the default request handler.</p> <p>## Root cause</p> <p>In `packages/waku/src/lib/utils/request.ts`:</p> <p>```ts // line 2…</p> https://cve.radiocsirt.org/vuln/ghsa-75w3-gmqx-993q