R2R npm Package Vulnerability: Critical SQL Injection Risk
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- R2R (npm)
- Patched version
- Not yet available
An early warning has been issued for a critical SQL injection vulnerability in the R2R npm package. Users of versions <=3.6.6 are reportedly at risk.
What happened
The R2R npm package has been flagged with a critical vulnerability identified as CVE-2026-82526. This vulnerability allows unauthenticated attackers to execute arbitrary SQL statements due to improper validation of the index name parameter in the vector index creation endpoint. The CVSS score of 9.8 indicates a severe risk. The vulnerability is under investigation and no exploitation in the wild has been confirmed yet.
Software engineers using R2R in their projects should assess their exposure by checking the version of R2R in use. Any version up to and including 3.6.6 is potentially vulnerable. It is recommended to review the package dependencies and consider upgrading or applying a workaround if available.
What to do about it
- Review your project dependencies to identify the version of R2R in use.
- If your project uses R2R version <=3.6.6, upgrade to a version that addresses the SQL injection vulnerability.
- Apply any available workarounds to mitigate the risk until an official fix is released.
- Monitor the NVD and other primary sources for updates on the vulnerability and any released patches.
How 0Day would have caught this
R2R is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using R2R npm package version <=3.6.6, you may be affected by this vulnerability.
What should I do right now?
Check the version of R2R you are using and upgrade to a secure version if you are on version <=3.6.6. Apply any available workarounds and monitor updates from primary sources.
Is there an official fix available?
No official fix has been published yet. Continue to monitor the primary sources for updates.