EUVD-2026-55688Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Payload is network-fetched and needs no privileges, but a developer must actively run npm install on an affected checkout, so UI:R; arbitrary code as the user yields full C/I/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
use-reducer-async is a React useReducer with async actions. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07, the default branch contained malicious commits da72edbde5705efcec6c62e0a3dcb73687b78dc8 through df07d5711458d8b46e11dd7afaaa21e88cafabfb that executed remote attacker-controlled code on developer machines during npm install. The commits were removed by force-push, but local clones, forks, and direct-SHA URLs may still contain them, and npm install against an affected checkout will still execute the code today. The package was not published to npm. src/install.js was added and wired into the postinstall script. It fetched a JavaScript payload from an attacker-controlled HTTPS endpoint (configurable via an environment variable), disabled TLS verification, and evaluated the response as code with require available. Execution was deliberately skipped on CI and cloud/serverless environments, targeting developer workstations. The second-stage payload was attacker-hosted and cannot be reconstructed. Assume full compromise of anything reachable from a Node process with the user's permissions. Those who ran npm install against an affected checkout on a developer machine on or after 2026-05-18 16:29:52 should treat the machine as compromised, rotate every credential the machine could reach, audit account activity since 2026-05-18 16:29:52, and clean local clones.
Articles & Coverage 1
AnalysisAI
Malicious code injection into the use-reducer-async GitHub repository (a small React useReducer-with-async-actions helper by dai-shi) turned developer workstations into remote-code-execution targets during npm install. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07 UTC the default branch carried attacker-planted commits (da72edb through df07d57) that added src/install.js, wired it into the postinstall hook, fetched an attacker-hosted second-stage payload over TLS-verification-disabled HTTPS, and eval'd it with require available. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to (1) obtain a checkout of dai-shi/use-reducer-async containing commits da72edb..df07d57 - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, high-priority supply-chain compromise for anyone who touched an affected checkout in the exposure window, but its blast radius is narrower than the 9.3 CVSS 4.0 base score suggests. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | There is no version-number patch to apply because the malicious code was never published to npm; the upstream fix was removal of the backdoor commits from the default branch via force-push (upstream fix available; treat the current clean default-branch HEAD as remediated), documented in GHSA-2786-p4vj-vx8x (https://github.com/dai-shi/use-reducer-async/security/advisories/GHSA-2786-p4vj-vx8x). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all development teams and CI/CD systems using use-reducer-async; scan git logs and lock files for commits da72edb through df07d57 from 2026-05-18 16:29:52 to 2026-05-19 15:26:07 UTC; isolate affected workstations from network access pending analysis. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
Same weakness CWE-506 – Embedded Malicious Code
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today