CVE-2026-49774 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-49774 requires immediate attention.

· 6 min read

Executive Summary

CVE-2026-49774 is a critical code injection flaw in Filipe Nasc RD Station with a CVSS score of 9.9. The issue can lead to remote code inclusion, which means an attacker may be able to force your application to load and execute malicious code. For solo developers and small teams, this is especially dangerous because a single exposed service, plugin, or dependency can become a full server compromise.

At the time of writing, this issue is not known to be in the CISA KEV catalog and not confirmed exploited in the wild, but that should not reduce urgency. The affected range is reported as RD Station: from n/a through 5.6.0. If you run this component directly or transitively, treat it as an emergency patch-and-verify event.

Immediate Action

  • Upgrade immediately to the first fixed release if available. If no fixed version is published yet, disable or remove the component until a patch exists. Vendor advisory / release notes
  • Isolate the service: restrict outbound network access, limit inbound exposure, and place the app behind authentication or a private network if possible.
  • Rollback if needed: if upgrading breaks production, roll back only to a known-safe build that does not include the vulnerable component, then apply compensating controls.
  • Search for exposed endpoints that accept user-controlled input, template names, plugin paths, file paths, or “include/import” style parameters.
  • Rotate secrets if the service was internet-facing or if you see signs of suspicious execution, file writes, or outbound callbacks.
  • Review logs now for unexpected process launches, shell commands, new files, or requests containing path traversal, template injection, or code-like payloads.

Affected Versions

  • RD Station <= 5.6.0 vulnerable
  • RD Station n/a through 5.6.0 vulnerable per advisory
  • RD Station > 5.6.0 presumed safe only if confirmed by vendor release notes or changelog
  • TODO_FIXED_VERSION replace with the first patched release once published

Resolution Guide

JavaScript / npm / yarn / pnpm

# npm
npm i rd-station@TODO_FIXED_VERSION

# yarn
yarn add rd-station@TODO_FIXED_VERSION

# pnpm
pnpm add rd-station@TODO_FIXED_VERSION

Python / pip / pipx

pip install --upgrade rd-station==TODO_FIXED_VERSION
pipx upgrade rd-station

Java / Maven / Gradle

<!-- Maven pom.xml -->
<dependency>
  <groupId>TODO_GROUP_ID</groupId>
  <artifactId>rd-station</artifactId>
  <version>TODO_FIXED_VERSION</version>
</dependency>

// Gradle
dependencies {
  implementation "TODO_GROUP_ID:rd-station:TODO_FIXED_VERSION"
}

Linux packages

# Debian/Ubuntu
sudo apt-get update
sudo apt-get install --only-upgrade rd-station

# RHEL/CentOS/Fedora
sudo yum update rd-station

Docker

# Replace vulnerable image tag with a fixed tag
docker pull TODO_REGISTRY/rd-station:TODO_FIXED_VERSION
docker run --rm TODO_REGISTRY/rd-station:TODO_FIXED_VERSION

Hardening examples

# Disable the vulnerable feature/module if your app supports it
export RD_STATION_DISABLE_CODE_LOADING=true

# Run with least privilege
docker run --read-only --cap-drop=ALL --security-opt no-new-privileges \
  -e RD_STATION_DISABLE_CODE_LOADING=true \
  TODO_REGISTRY/rd-station:TODO_FIXED_VERSION

Minimal code fix pattern — never pass user input into code-loading or include-like functions:

// BAD
loadModule(req.query.module)

// GOOD
const allowed = new Set(["safeA", "safeB"])
if (!allowed.has(req.query.module)) {
  throw new Error("Invalid module")
}
loadModule(req.query.module)

Detection & Verification

Check installed versions

npm ls rd-station
yarn list --pattern rd-station
pnpm list rd-station
pip show rd-station
mvn dependency:tree | grep -i rd-station
gradle dependencies | grep -i rd-station
dpkg -l | grep -i rd-station
rpm -qa | grep -i rd-station
docker image ls | grep -i rd-station

Look for risky code paths

grep -RInE "include|require|import|eval|exec|spawn|system|loadModule|loadFile" .

Verify the fix

# Confirm the version is above the vulnerable range
npm ls rd-station
pip show rd-station
docker inspect --format='{{.Config.Image}}' CONTAINER_ID

# Re-run dependency audits
npm audit
yarn audit
pip-audit
mvn -q dependency:tree

If you have a staging environment, send a harmless request to the previously risky endpoint and confirm it now rejects unexpected input with a 4xx error, not a code path execution or file load.

Risk and Impact

This vulnerability can allow an attacker to execute or include malicious code on the server, which may lead to full application compromise, data theft, credential exposure, and persistence. For small teams, the blast radius can include source code, API keys, customer data, CI/CD secrets, and cloud credentials if the service has broad permissions. If the affected component is internet-facing, assume the attacker can move quickly from a single request to server takeover.

Keep reading