CVE-2026-24474CWE-94CWE-95

Dioxus Components has JavaScript injection via user-supplied IDs

Medium · published January 23, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
34.5
In the wild
Unconfirmed
What it is

Dioxus Components is a shadcn-style component library for the Dioxus app framework. Prior to commit 41e4242ecb1062d04ae42a5215363c1d9fd4e23a, `use_animated_open` formats a string for `eval` with an `id` that can be user supplied. Commit 41e4242ecb1062d04ae42a5215363c1d9fd4e23a patches the issue.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00413 · 34.5th percentile
Weaknesses
CWE-94 · Improper Control of Generation of Code ('Code Injection'); CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Published
2026-01-23T23:50Z
EPSS history
Timeline
  • 23 JAN 23:50Z
    Dioxus Components has JavaScript injection via user-supplied IDs
    cvelistv5