redwoodjs/sdk

redwoodjs/sdk

Releases481

Frequency23 hours

Last Release 4 days ago

Stars1.66K

A simple framework for humans Server-first React, running on the Cloudflare platform. Simple to build. Easy to maintain.

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2026-42190 ↗	May 8, 2026Friday, 8 May 2026, 20:16	5.3 MEDIUM	—
RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim's session cookie attached. This issue has been patched in version 1.2.3.
CVE-2026-39371 ↗	Apr 7, 2026Tuesday, 7 April 2026, 20:16	8.1 HIGH	—
RedwoodSDK is a server-first React framework. From 1.0.0-beta.50 to 1.0.5, erver functions exported from "use server" files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions, because browsers send SameSite=Lax cookies on top-level GET requests. This affected all server functions -- both serverAction() handlers and bare exported functions in "use server" files. This vulnerability is fixed in 1.0.6.