NPM · SEPTEMBER 2026 · EARLY WARNING

R2R npm Package Vulnerability: Critical SQL Injection Risk

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
Severity
CRITICAL
CVSS
9.8
Affected component
R2R (npm)
Patched version
Not yet available
CVE-2026-82526

An early warning has been issued for a critical SQL injection vulnerability in the R2R npm package. Users of versions <=3.6.6 are reportedly at risk.

What happened

The R2R npm package has been flagged with a critical vulnerability identified as CVE-2026-82526. This vulnerability allows unauthenticated attackers to execute arbitrary SQL statements due to improper validation of the index name parameter in the vector index creation endpoint. The CVSS score of 9.8 indicates a severe risk. The vulnerability is under investigation and no exploitation in the wild has been confirmed yet.

Software engineers using R2R in their projects should assess their exposure by checking the version of R2R in use. Any version up to and including 3.6.6 is potentially vulnerable. It is recommended to review the package dependencies and consider upgrading or applying a workaround if available.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If R2R is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

If you are using R2R npm package version <=3.6.6, you may be affected by this vulnerability.

What should I do right now?

Check the version of R2R you are using and upgrade to a secure version if you are on version <=3.6.6. Apply any available workarounds and monitor updates from primary sources.

Is there an official fix available?

No official fix has been published yet. Continue to monitor the primary sources for updates.

Sources

Join the 0Day waitlist →

← Back to all threats