RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests

published 2026-04-07 7 mo ago modified 2026-07-24 3 mo ago also GHSA-x8rx-789c-2pxq , EUVD-2026-19888

cvss: 8.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 11%
public exploits: 0; none known

RedwoodSDK is a server-first React framework. From 1.0.0-beta.50 to 1.0.5, erver functions exported from "use server" files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions, because browsers send SameSite=Lax cookies on top-level GET requests. This affected all server functions -- both serverAction() handlers and bare exported functions in "use server" files. This vulnerability is fixed in 1.0.6.

Patch / fix

fixed in 2

npm rwsdk 1.0.6
redwoodjs redwoodsdk 1.0.6

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 7 mo ago (2026-04-08)

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
GitHub	3.1	8.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	rwsdk	>=1.0.0-beta.50, <1.0.6	1.0.6

Affected products

redwoodjs sdk

Classification

Weakness

CWE-352 Cross-Site Request Forgery

References

github.com /redwoodjs/sdk/security/advisories/GHSA-x8rx-789c-2pxq
web, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2026-39371
advisory
github.com /redwoodjs/sdk
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary