CVE-2026-24474: RCE in Dioxus Components JavaScript Library

The impact of CVE-2026-24474 is severe, enabling an attacker to achieve Remote Code Execution (RCE) on systems utilizing vulnerable Dioxus Components. This means an attacker could potentially gain complete control over the affected application and its underlying infrastructure. Successful exploitation could lead to data breaches, system compromise, and further lateral movement within a network. The ability to execute arbitrary code opens the door to a wide range of malicious activities, including installing malware, stealing sensitive data, and disrupting services. This vulnerability shares similarities with other eval-based injection flaws, where user-supplied input is directly incorporated into code execution, bypassing security controls.

1. Reserved2026-01-23
2. Published2026-01-23
3. Modified2026-01-26
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-24474 is to immediately upgrade to version 41e4242ecb1062d04ae42a5215363c1d9fd4e23a or later. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the id parameter passed to the useanimatedopen function to prevent malicious code injection. While a direct workaround is difficult without modifying the library, strict input validation can reduce the attack surface. Review your application's code for any instances where user-supplied data is used in eval calls and implement robust security measures. After upgrading, confirm the fix by attempting to trigger the vulnerable function with a malicious id parameter; it should now be properly sanitized.