RSEC-2026-0
Cross-site Request Forgery (CSRF) vulnerability
Published Feb 18, 2026 · updated Feb 18, 2026
The widgetframe R package is exposed to a vulnerability due to its use of the Pym.js library version 1.3.1. This can result in arbitrary javascript code execution.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Feb 18, 2026 · OSV.dev
Detected
The widgetframe R package is exposed to a vulnerability due to its use of the Pym.js library version 1.3.1. This can result in arbitrary javascript code execution.
Feb 18, 2026 · OSV.dev
Updated
The widgetframe R package is exposed to a vulnerability due to its use of the Pym.js library version 1.3.1. This can result in arbitrary javascript code execution.
Affected
- CRAN widgetframe0.1.0, 0.2.0, 0.3.0