CVE-2026-24474: Dioxus Components RCE Vulnerability

CVE-2026-24474 Overview

A code injection vulnerability has been identified in Dioxus Components, a shadcn-style component library for the Dioxus app framework. The vulnerability exists in the use_animated_open function, which formats a string for eval using an id parameter that can be user-supplied. This allows attackers to potentially inject and execute arbitrary code through crafted input values passed to the vulnerable function.

Critical Impact
Attackers can exploit user-controlled input in the use_animated_open function to inject malicious code through the eval operation, potentially leading to unauthorized code execution within the application context.

Affected Products

Dioxus Components library (versions prior to commit 41e4242ecb1062d04ae42a5215363c1d9fd4e23a)

Discovery Timeline

2026-01-24 - CVE CVE-2026-24474 published to NVD
2026-01-26 - Last updated in NVD database

Technical Details for CVE-2026-24474

Vulnerability Analysis

This vulnerability falls under CWE-94 (Improper Control of Generation of Code), commonly known as Code Injection. The use_animated_open function in the Dioxus Components library constructs a string that is passed to an eval function, incorporating an id parameter that can be influenced by user input. Because the input is not properly sanitized or validated before being concatenated into the evaluated string, an attacker can craft malicious input that breaks out of the intended context and executes arbitrary code.

The network-based attack vector allows remote exploitation without requiring authentication, though user interaction is necessary to trigger the vulnerable code path. Successful exploitation can result in limited impacts to both confidentiality and integrity within the application's execution context.

Root Cause

The root cause of this vulnerability is improper input validation combined with unsafe use of dynamic code evaluation. The use_animated_open function directly interpolates user-controllable data into a string that is subsequently evaluated as code without adequate sanitization. This pattern is inherently dangerous as it allows input that was intended as data to be interpreted as executable code.

Attack Vector

The attack is network-accessible and requires some form of user interaction to trigger. An attacker would need to supply a specially crafted id value that, when processed by the use_animated_open function, breaks out of the expected string context and injects additional code to be executed by the eval call. This could be achieved through various means depending on how the application exposes the vulnerable component to user input.

The vulnerability mechanism involves string interpolation into an eval context. When the use_animated_open function receives an attacker-controlled id parameter, the value is formatted directly into a string that gets evaluated as code. By crafting input that includes code delimiters or escape sequences, an attacker can escape the intended data context and inject arbitrary executable code. For detailed technical analysis, refer to the GitHub Security Advisory GHSA-34pj-292j-xr69.

Detection Methods for CVE-2026-24474

Indicators of Compromise

Unusual or malformed id parameter values containing code injection patterns (e.g., escape sequences, semicolons, or function calls)
Application logs showing unexpected JavaScript or code execution errors related to animation components
Anomalous behavior in application components using use_animated_open functionality

Detection Strategies

Implement input validation monitoring to detect injection patterns in id parameters
Deploy Web Application Firewall (WAF) rules to identify and block code injection attempts targeting the vulnerable function
Utilize application security testing tools to scan for dynamic code evaluation vulnerabilities

Monitoring Recommendations

Monitor application logs for unexpected eval-related errors or exceptions
Set up alerts for abnormal input patterns being passed to animation-related component functions
Review code changes and dependencies to ensure patched versions are deployed

How to Mitigate CVE-2026-24474

Immediate Actions Required

Update Dioxus Components to include commit 41e4242ecb1062d04ae42a5215363c1d9fd4e23a or later
Audit application code for any direct usage of the use_animated_open function with user-supplied input
Implement input validation on any user-controllable parameters passed to animation components

Patch Information

The vulnerability has been patched in commit 41e4242ecb1062d04ae42a5215363c1d9fd4e23a. Organizations using the Dioxus Components library should update their dependencies to include this commit or any subsequent release that incorporates this fix. The patch can be reviewed in the DioxusLabs Commit Update.

Workarounds

If immediate patching is not possible, implement strict input validation on all id values before they are passed to use_animated_open
Sanitize user input by removing or escaping characters that could break out of string contexts
Consider disabling or replacing animation functionality that relies on the vulnerable function until the patch can be applied

bash

# Update Dioxus Components to the patched version
# Ensure your Cargo.toml points to a version including the security fix
cargo update -p dioxus-components

# Verify the patched commit is included in your dependencies
cargo tree -p dioxus-components