Executive brief
RedwoodSDK is a framework used to build web applications. A security flaw allowed sensitive server-side actions to be triggered through simple web links (GET requests) instead of requiring secure form submissions. If a logged-in user clicks a malicious link, an attacker could perform unauthorized actions on their behalf, such as deleting data or changing account settings, potentially leading to data loss or service disruption.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in RedwoodSDK (rwsdk) due to improper enforcement of HTTP methods for server functions. Functions exported from 'use server' files, including serverAction() handlers, could be invoked via GET requests even when they were intended to be POST-only. Because browsers send SameSite=Lax cookies during top-level GET navigations, an attacker can craft a malicious URL with a known action ID and JSON-encoded arguments to execute state-changing operations using a victim's active session. This allows for unauthorized data mutations or deletions. The vulnerability is fixed in version 1.0.6, which enforces the correct HTTP method at dispatch time.
Affected products
- RedwoodJS RedwoodSDK (rwsdk) >= 1.0.0-beta.50, <= 1.0.5
Timeline
- 2026-04-06: advisory: GitHub Security Advisory published
- 2026-04-07: disclosed: CVE-2026-39371 published
- 2026-04-07: patched: Fixed in version 1.0.6