Redux DevTools CVE-2026-117526

Exploitation requires local access to a system running the redux-devtools 5.0.0 Remotedev Server component (AV:L) together with low-level privileges (PR:L), after which a crafted value supplied to the action argument of the evalAction function results in code injection. No user interaction is required (UI:N). Exploitation is sharply limited by the local-only attack vector and the need for pre-existing privilege - this is developer/debugging infrastructure, so an attacker must already be able to reach the Remotedev Server locally. The precise trigger mechanism (how the action argument is reached and what input is accepted) is not described in the available sources, and no vendor-confirmed fix or affected-configuration guidance is available.

This is a low-priority issue despite its code-injection (CWE-94) classification, and the signals are internally consistent rather than conflicting. The reporter-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) and resulting base score of 1.9 both point to a local, privilege-requiring flaw with only low impact to confidentiality, integrity and availability - not the network-exploitable RCE that the 'Code Injection'/'RCE' tags might suggest in isolation. There is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation; the vuln.today Decision label is 'monitor', the lowest urgency tier, which aligns with the low CVSS. The only exploitation signal is a public PoC reference (a GitHub issue), and per the input it is a reference only, not verified as working exploit code, so it should not be treated as a weaponized exploit. The disclosure note that the project 'has not responded yet' means no vendor-confirmed fix exists, but given local-only access and low impact this is a watch-and-patch-when-available item, not an emergency. The one caveat to verify: the 'RCE' tag overstates reach - the authoritative CVSS vector says the vector is local (AV:L), so confirm with the vendor/NVD before treating this as remotely exploitable.

A user who already has local access to a machine running the Remotedev Server component passes a crafted value into the action argument handled by the evalAction function, causing attacker-controlled code to be injected and executed within the dev-tools server process. A public PoC reference exists as a GitHub issue, but it is not verified as working exploit code, so real-world exploitation would likely require an attacker to adapt it. Because the CVSS vector is AV:L/PR:L, the attacker needs local access and some existing privilege, which sharply limits realistic reach.