GHSA-X8RX-789C-2PXQ

Vulnerability from github – Published: 2026-04-08 00:12 – Updated: 2026-04-08 00:12
VLAI?
Summary
RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests
Details

Summary

Server functions exported from "use server" files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions, because browsers send SameSite=Lax cookies on top-level GET requests.

This affected all server functions -- both serverAction() handlers and bare exported functions in "use server" files.

Impact

An attacker could construct a URL containing a known action ID and JSON-encoded arguments. When a victim with an active session visited or was redirected to this URL, the function executed with the victim's credentials. This affected any server function that performs state-changing operations (writes, deletes, mutations) in applications using cookie-based authentication.

Remediation

Update to rwsdk 1.0.6. No application code changes are required.

The fix enforces the declared HTTP method at dispatch time. GET requests to server functions that require POST now return 405 Method Not Allowed.

Severity ?
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.0.5"
      },
      "package": {
        "ecosystem": "npm",
        "name": "rwsdk"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0-beta.50"
            },
            {
              "fixed": "1.0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-39371"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-08T00:12:06Z",
    "nvd_published_at": "2026-04-07T20:16:31Z",
    "severity": "HIGH"
  },
  "details": "**Summary**\n\nServer functions exported from `\"use server\"` files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions, because browsers send `SameSite=Lax` cookies on top-level GET requests.\n\nThis affected all server functions -- both `serverAction()` handlers and bare exported functions in `\"use server\"` files.\n\n**Impact**\n\nAn attacker could construct a URL containing a known action ID and JSON-encoded arguments. When a victim with an active session visited or was redirected to this URL, the function executed with the victim\u0027s credentials. This affected any server function that performs state-changing operations (writes, deletes, mutations) in applications using cookie-based authentication.\n\n**Remediation**\n\nUpdate to rwsdk `1.0.6`. No application code changes are required.\n\nThe fix enforces the declared HTTP method at dispatch time. GET requests to server functions that require POST now return `405 Method Not Allowed`.",
  "id": "GHSA-x8rx-789c-2pxq",
  "modified": "2026-04-08T00:12:06Z",
  "published": "2026-04-08T00:12:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/redwoodjs/sdk/security/advisories/GHSA-x8rx-789c-2pxq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39371"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/redwoodjs/sdk"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.