{"id":"CVE-2026-39371","aliases":["EUVD-2026-19888","GHSA-x8rx-789c-2pxq"],"status":"published","title":"RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests","description":"RedwoodSDK is a server-first React framework. From 1.0.0-beta.50 to 1.0.5, erver functions exported from \"use server\" files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions, because browsers send SameSite=Lax cookies on top-level GET requests. This affected all server functions -- both serverAction() handlers and bare exported functions in \"use server\" files. This vulnerability is fixed in 1.0.6.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00214,"percentile":0.11876,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-352"],"published":"2026-04-07T19:28:30Z","modified":"2026-10-28T02:30:42Z","exploits":[{"source":"pocgithub","id":"zebbernCVE/CVE-2026-39371","title":"zebbernCVE/CVE-2026-39371","date":"2026-04-07","url":"https://github.com/zebbernCVE/CVE-2026-39371"}],"fixes":[{"ecosystem":"npm","package":"rwsdk","fixed_in":["1.0.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"rwsdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0-beta.50"},{"last_affected":"1.0.5"},{"fixed":"1.0.6"}]}]},{"source":"osv","ecosystem":"npm","package":"rwsdk","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0-beta.50"},{"fixed":"1.0.6"}]}]}],"products":[{"vendor":"redwoodjs","product":"redwoodsdk"},{"vendor":"redwoodjs","product":"sdk"}],"references":[{"url":"https://github.com/redwoodjs/sdk/security/advisories/GHSA-x8rx-789c-2pxq","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39371","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x8rx-789c-2pxq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39371.json","tags":["advisory"]},{"url":"https://github.com/redwoodjs/sdk","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-39371","title":"RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests","description":"RedwoodSDK is a server-first React framework. From 1.0.0-beta.50 to 1.0.5, erver functions exported from \"use server\" files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions, because browsers send SameSite=Lax cookies on top-level GET requests. This affected all server functions -- both serverAction() handlers and bare exported functions in \"use server\" files. This vulnerability is fixed in 1.0.6.","status":"published","published":"2026-04-07T19:28:30.941Z","modified":"2026-04-08T17:46:55.661Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:20:02.662847Z"}],"euvd":[{"id":"EUVD-2026-19888","description":"RedwoodSDK is a server-first React framework. From 1.0.0-beta.50 to 1.0.5, erver functions exported from \"use server\" files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions, because browsers send SameSite=Lax cookies on top-level GET requests. This affected all server functions -- both serverAction() handlers and bare exported functions in \"use server\" files. This vulnerability is fixed in 1.0.6.","status":"published","published":"2026-04-07T19:28:30Z","modified":"2026-04-08T17:46:55Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:24:31.776051Z"}],"ghsa":[{"id":"GHSA-x8rx-789c-2pxq","title":"RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests","description":"**Summary**\n\nServer functions exported from `\"use server\"` files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions, because browsers send `SameSite=Lax` cookies on top-level GET requests.\n\nThis affected all server functions -- both `serverAction()` handlers and bare exported functions in `\"use server\"` files.\n\n**Impact**\n\nAn attacker could construct a URL containing a known action ID and JSON-encoded arguments. When a victim with an active session visited or was redirected to this URL, the function executed with the victim's credentials. This affected any server function that performs state-changing operations (writes, deletes, mutations) in applications using cookie-based authentication.\n\n**Remediation**\n\nUpdate to rwsdk `1.0.6`. No application code changes are required.\n\nThe fix enforces the declared HTTP method at dispatch time. GET requests to server functions that require POST now return `405 Method Not Allowed`.","status":"published","published":"2026-04-08T00:12:06Z","modified":"2026-04-08T00:12:07Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:39:51.193071Z"}],"nvd":[{"id":"CVE-2026-39371","description":"RedwoodSDK is a server-first React framework. From 1.0.0-beta.50 to 1.0.5, erver functions exported from \"use server\" files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions, because browsers send SameSite=Lax cookies on top-level GET requests. This affected all server functions -- both serverAction() handlers and bare exported functions in \"use server\" files. This vulnerability is fixed in 1.0.6.","status":"published","published":"2026-04-07T20:16:31.98Z","modified":"2026-07-24T21:10:00.143Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:12:13.535987Z"}],"osv":[{"id":"CVE-2026-39371","title":"RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests","description":"RedwoodSDK is a server-first React framework. From 1.0.0-beta.50 to 1.0.5, erver functions exported from \"use server\" files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions, because browsers send SameSite=Lax cookies on top-level GET requests. This affected all server functions -- both serverAction() handlers and bare exported functions in \"use server\" files. This vulnerability is fixed in 1.0.6.","status":"published","published":"2026-04-07T19:28:30.941Z","modified":"2026-10-28T02:30:42.072115632Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:45:03.040464Z"},{"id":"GHSA-x8rx-789c-2pxq","title":"RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests","description":"**Summary**\n\nServer functions exported from `\"use server\"` files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions, because browsers send `SameSite=Lax` cookies on top-level GET requests.\n\nThis affected all server functions -- both `serverAction()` handlers and bare exported functions in `\"use server\"` files.\n\n**Impact**\n\nAn attacker could construct a URL containing a known action ID and JSON-encoded arguments. When a victim with an active session visited or was redirected to this URL, the function executed with the victim's credentials. This affected any server function that performs state-changing operations (writes, deletes, mutations) in applications using cookie-based authentication.\n\n**Remediation**\n\nUpdate to rwsdk `1.0.6`. No application code changes are required.\n\nThe fix enforces the declared HTTP method at dispatch time. GET requests to server functions that require POST now return `405 Method Not Allowed`.","status":"published","published":"2026-04-08T00:12:06Z","modified":"2026-04-08T00:27:17.091327Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:59.835583Z"}]}}