GHSA-x8rx-789c-2pxq
Suggest an improvement- Source
- https://github.com/advisories/GHSA-x8rx-789c-2pxq
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-x8rx-789c-2pxq/GHSA-x8rx-789c-2pxq.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-x8rx-789c-2pxq
- Aliases
- Published
- 2026-04-08T00:12:06Z
- Modified
- 2026-04-08T00:27:17Z
- Severity
-
- 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVSS Calculator
- Summary
- RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests
- Details
-
Summary
Server functions exported from
"use server"files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions, because browsers sendSameSite=Laxcookies on top-level GET requests.This affected all server functions -- both
serverAction()handlers and bare exported functions in"use server"files.Impact
An attacker could construct a URL containing a known action ID and JSON-encoded arguments. When a victim with an active session visited or was redirected to this URL, the function executed with the victim's credentials. This affected any server function that performs state-changing operations (writes, deletes, mutations) in applications using cookie-based authentication.
Remediation
Update to rwsdk
1.0.6. No application code changes are required.The fix enforces the declared HTTP method at dispatch time. GET requests to server functions that require POST now return
405 Method Not Allowed. - Database specific
{ "cwe_ids": [ "CWE-352" ], "github_reviewed": true, "github_reviewed_at": "2026-04-08T00:12:06Z", "nvd_published_at": "2026-04-07T20:16:31Z", "severity": "HIGH" }- References
Affected packages
npm / rwsdk
Package
- Name
- rwsdk
- View open source insights on deps.dev
- Purl
- pkg:npm/rwsdk