CVE-2026-117526

MediumCVSS 5.3/10Last modified Nov 3, 2026

Description

A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by this vulnerability is the function evalAction of the component Remotedev Server. The manipulation of the argument action results in code injection. The attack is only possible with local access. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-94

Affected software

Vendor	Product	Versions
reduxjs	redux-devtools	5.0.0

References

Timeline

Published: Oct 27, 2026
Last modified: Nov 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-117535.1A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is reflected into the HTT CVE-2026-1175306.7In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands CVE-2026-1175315.9@fastify/multipart is the multipart form-data and file upload plugin for the Fastify web framework. In versions 5.3.0 through 10.1.6, the pl CVE-2026-1175329.8REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthentic CVE-2026-1175334.4REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves uploaded SVG files int CVE-2026-1175345.4REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete his CVE-2026-1175356.1REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the opener_link pa CVE-2026-1175368.8REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the C CVE-2026-1175374.1REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the t CVE-2026-1175384.1REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is co CVE-2026-1175393.5darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed exte CVE-2026-117545.3Observable discrepancy vulnerability in Seres Software syWEB allows Account Footprinting. This issue affects syWEB: through 27082026. NOTE: