Cross-Site Vulnerabilities in RedwoodSDK Framework by RedwoodJS

CVE-2026-39371

What is CVE-2026-39371?

RedwoodSDK, a server-first React framework, contains a vulnerability where server functions, defined in 'use server' files, can be invoked through GET requests, disregarding their designated HTTP methods. This flaw enables attackers to exploit cookie-authenticated applications, triggering state-changing operations via cross-site GET navigations. Browsers deliver SameSite=Lax cookies during top-level GET requests, facilitating such unauthorized function calls. This concern is prevalent across all server actions, including serverAction() handlers and directly exported functions. This issue has been resolved in version 1.0.6.

References