Remote Code Execution Vulnerability in use-reducer-async by Dai Shi
CVE-2026-48159

9.3CRITICAL

Key Information:

Vendor

Dai-shi

Status
Use-reducer-async
Vendor
CVE Published:
10 August 2026

What is CVE-2026-48159?

The use-reducer-async package experienced a significant remote code execution vulnerability due to malicious commits introduced between May 18, 2026, and May 19, 2026. These commits, although subsequently removed, could still exist in local clones, forks, and direct SHA URLs. When developers executed npm install on affected checkouts, the code could fetch and execute a malicious JavaScript payload from an attacker-controlled endpoint, while deliberately skipping execution in CI environments. This targeted developer workstations, leading to a potential full compromise of any system resources accessible from a Node process with user permissions. Developers who interacted with the compromised versions should treat their systems as insecure, rotate credentials, and audit related account activities.

Affected Version(s)

use-reducer-async >= da72edbde5705efcec6c62e0a3dcb73687b78dc8, <= df07d5711458d8b46e11dd7afaaa21e88cafabfb

References

https://github.com/dai-shi/use-reducer-async/security/adv...
x_refsource_CONFIRM

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.