Redux Devtools
Monthly
Code injection in the Remotedev Server component of redux-devtools 5.0.0 allows a locally positioned attacker with low-level privileges to inject code through a crafted value passed to the action argument of the evalAction function. Because the attack vector is local (AV:L) and requires pre-existing privileges (PR:L), the practical exposure is confined to developer and debugging environments where the Remotedev Server is reachable by an already-present user; no user interaction is needed. The flaw was reported to the project through a GitHub issue (reduxjs/redux-devtools#2125) but no vendor response or patch has been identified, and a public PoC reference exists that is not verified as working exploit code - no confirmed active exploitation (CISA KEV) was recorded, and the priority assessment is 'monitor'.
Code injection in the Remotedev Server component of redux-devtools 5.0.0 allows a locally positioned attacker with low-level privileges to inject code through a crafted value passed to the action argument of the evalAction function. Because the attack vector is local (AV:L) and requires pre-existing privileges (PR:L), the practical exposure is confined to developer and debugging environments where the Remotedev Server is reachable by an already-present user; no user interaction is needed. The flaw was reported to the project through a GitHub issue (reduxjs/redux-devtools#2125) but no vendor response or patch has been identified, and a public PoC reference exists that is not verified as working exploit code - no confirmed active exploitation (CISA KEV) was recorded, and the priority assessment is 'monitor'.