Threats affecting pkg:npm/reduxjs/redux-devtools

CVE-2026-117526 is a code injection vulnerability in reduxjs redux-devtools version 5.0.0. It affects the evalAction function of the Remotedev Server component. The vulnerability allows an attacker with local access to manipulate the action argument to inject code. Exploit code has been publicly disclosed. The project has been informed but has not yet responded or issued a fix.