{"id":"UBUNTU-CVE-2026-117526","details":"A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by this vulnerability is the function evalAction of the component Remotedev Server. The manipulation of the argument action results in code injection. The attack is only possible with local access. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.","modified":"2026-10-28T20:17:46.302308773Z","published":"2026-10-27T18:17:00Z","upstream":["CVE-2026-117526"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-117526"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-117526"},{"type":"REPORT","url":"https://github.com/reduxjs/redux-devtools/"},{"type":"REPORT","url":"https://github.com/reduxjs/redux-devtools/issues/2125"},{"type":"REPORT","url":"https://vuldb.com/cve/CVE-2026-117526"},{"type":"REPORT","url":"https://vuldb.com/submit/1025061"},{"type":"REPORT","url":"https://vuldb.com/vuln/427087"},{"type":"REPORT","url":"https://vuldb.com/vuln/427087/cti"}],"affected":[{"package":{"name":"node-redux-devtools","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/node-redux-devtools?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.13.1~git20230831-2"],"ecosystem_specific":{"binaries":[{"binary_name":"node-map2tree","binary_version":"3.0.0~3.13.1~git20230831-2"},{"binary_name":"node-react-base16-styling","binary_version":"0.9.1~3.13.1~git20230831-2"},{"binary_name":"node-react-dock","binary_version":"0.6.0~3.13.1~git20230831-2"},{"binary_name":"node-react-json-tree","binary_version":"0.18.0~3.13.1~git20230831-2"},{"binary_name":"node-redux-devtools-core","binary_version":"3.13.1~git20230831-2"},{"binary_name":"node-redux-devtools-extension","binary_version":"3.2.5~3.13.1~git20230831-2"},{"binary_name":"node-redux-devtools-serialize","binary_version":"0.4.1~3.13.1~git20230831-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-117526.json"}},{"package":{"name":"node-redux-devtools","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/node-redux-devtools?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.13.1~git20230831-2","3.13.1~git20230831-4","3.13.1~git20230831-5"],"ecosystem_specific":{"binaries":[{"binary_name":"node-map2tree","binary_version":"3.0.0~3.13.1~git20230831-5"},{"binary_version":"0.9.1~3.13.1~git20230831-5","binary_name":"node-react-base16-styling"},{"binary_name":"node-react-dock","binary_version":"0.6.0~3.13.1~git20230831-5"},{"binary_name":"node-react-json-tree","binary_version":"0.18.0~3.13.1~git20230831-5"},{"binary_name":"node-redux-devtools-core","binary_version":"3.13.1~git20230831-5"},{"binary_name":"node-redux-devtools-extension","binary_version":"3.2.5~3.13.1~git20230831-5"},{"binary_name":"node-redux-devtools-serialize","binary_version":"0.4.1~3.13.1~git20230831-5"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-117526.json"}},{"package":{"name":"node-redux-devtools","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/node-redux-devtools?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.13.1~git20230831-2"],"ecosystem_specific":{"binaries":[{"binary_version":"3.0.0~3.13.1~git20230831-2","binary_name":"node-map2tree"},{"binary_name":"node-react-base16-styling","binary_version":"0.9.1~3.13.1~git20230831-2"},{"binary_name":"node-react-dock","binary_version":"0.6.0~3.13.1~git20230831-2"},{"binary_name":"node-react-json-tree","binary_version":"0.18.0~3.13.1~git20230831-2"},{"binary_version":"3.13.1~git20230831-2","binary_name":"node-redux-devtools-core"},{"binary_version":"3.2.5~3.13.1~git20230831-2","binary_name":"node-redux-devtools-extension"},{"binary_name":"node-redux-devtools-serialize","binary_version":"0.4.1~3.13.1~git20230831-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-117526.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"},{"type":"Ubuntu","score":"medium"}]}