Skip to main content

React Router CVE-2026-22029

MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-01-10 security-advisories@github.com GHSA-2w69-qvjg-hvjx
XSS Open Redirect React Router Remix Run React Shopify
6.1
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Attacker crafts untrusted redirect URL
  2. Exploit
    Loader or action processes malicious input
  3. Execution
    SPA navigates to javascript: URL
  4. Impact
    Malicious code executes in browser context

Vulnerability Assessment

Weakness
CWE
CWE-79
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK

2 techniques across 2 tactics: Initial Access, Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

React Router 7.0.0-7.11.0 or @remix-run/router <1.23.2 with Framework Mode, Data Mode, or unstable RSC modes enabled (NOT Declarative Mode). Application must construct redirect paths from untrusted content without sanitization.
Impact

CVSS 8.0 (HIGH). Attack vector: Network. Complexity: High. Privileges required: None. User interaction: Required.
Exploit ScenarioDerived

An attacker could exploit this vulnerability to unsafe URLs causing unintended javascript execution on the client.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

React Router is a router for React. In @remix-run/router version prior to 1.23.2. [CVSS 8.0 HIGH]

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.

Affected Packages

npm @remix-run/router fix: 1.23.2
npm react-router fix: 7.12.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Remix-Run\/React. React Router is a router for React. In @remix-run/router version prior to 1.23.2. and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (

Know when React Router gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 6.1 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
SUSE MEDIUM
Red Hat 8.0 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

4
Severity Changed
Jun 30, 2026 - 03:23 NVD
HIGH MEDIUM
CVSS changed
Jun 30, 2026 - 03:23 NVD
8.0 (HIGH) 6.1 (MEDIUM)
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Jan 10, 2026 - 03:15 nvd
HIGH 8.0

DescriptionNVD

React Router is a router for React. In @remix-run/router version prior to 1.23.2. and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<BrowserRouter>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 7 npm packages depend on react-router (3 direct, 4 indirect)

Ecosystem-wide dependent count for version 7.0.0.

Executive ViewAI

Why It Matters

Organizations using React Router face notable risk from CVE-2026-22029, a cross-site scripting vulnerability rated CVSS 8.0. Attackers could inject malicious scripts to steal user sessions, credentials, or perform actions on behalf of authenticated users. Organizations should apply vendor updates when available and consider compensating controls in the interim.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement Content-Security-Policy headers; (2) Enable HttpOnly and SameSite cookie attributes; (3) Deploy WAF XSS/CSRF rules.

Threat Intelligence Overview

EPSS Score
0.0%
Top 97% exploitable
Data Quality
6 sources
Confidence: High
NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

30
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +30
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Cross-Site Scripting MEDIUM

Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.

Affected Products (CPE)NVD

cpe:2.3:a:shopify:remix-run\/react:*:*:*:*:*:node.js:*:*
cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:*

More in React Router

View all
CVE-2026-42211 HIGH POC
8.1 Jun 02

Remote code execution in React Router 7.0.0 through 7.14.1 affects applications running in Framework Mode by chaining an
CVE-2026-42342 HIGH POC
7.5 Jun 02

Denial of service in React Router 7.0.0-7.14.x and @remix-run/server-runtime 2.10.0-2.17.4 allows remote unauthenticated
CVE-2026-34077 HIGH POC
7.5 Jun 02

Client-side Cross-Site Scripting in React Router 7.7.0 through 7.13.1 affects applications using the unstable React Serv
CVE-2026-40181 MEDIUM POC
6.6 Jun 02

Open redirect in React Router's programmatic `redirect()` function allows unauthenticated remote attackers to redirect u
CVE-2026-21884 HIGH
8.2 Jan 10

React Router is a router for React. In @remix-run/react version prior to 2.17.3. [CVSS 8.2 HIGH]
CVE-2025-59057 HIGH
7.6 Jan 10

React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. [CVSS 7.6 HIGH]
CVE-2025-68470 MEDIUM
6.5 Jan 10

React-Router versions up to 6.30.1 is affected by url redirection to untrusted site (open redirect) (CVSS 6.5).
CVE-2026-22030 MEDIUM
6.5 Jan 10

React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. [CVSS 6.5 MEDIUM]
CVE-2026-33244 MEDIUM
5.4 Jun 02

Cross-site scripting in React Router's Framework Mode (versions 7.5.1-7.13.1) allows an authenticated attacker with infl
CVE-2026-33245 MEDIUM
4.7 Jun 02

Client-side cross-site scripting in React Router 7.7.0 through 7.13.1 allows remote attackers to execute arbitrary scrip

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2013-1710 CRITICAL POC
10.0
CVE-2024-52875 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Module for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 Fixed
SUSE Linux Enterprise Server 16.0 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:1517 ADVISORY https://access.redhat.com/errata/RHSA-2026:2147 ADVISORY https://access.redhat.com/errata/RHSA-2026:2148 ADVISORY https://access.redhat.com/errata/RHSA-2026:2149 ADVISORY https://access.redhat.com/errata/RHSA-2026:2350 ADVISORY https://access.redhat.com/errata/RHSA-2026:2456 ADVISORY https://access.redhat.com/errata/RHSA-2026:2568 ADVISORY https://access.redhat.com/errata/RHSA-2026:2572 ADVISORY https://access.redhat.com/errata/RHSA-2026:2694 ADVISORY https://access.redhat.com/errata/RHSA-2026:3087 ADVISORY https://access.redhat.com/errata/RHSA-2026:3782 ADVISORY https://access.redhat.com/errata/RHSA-2026:3958 ADVISORY https://access.redhat.com/errata/RHSA-2026:3959 ADVISORY https://access.redhat.com/errata/RHSA-2026:3960 ADVISORY https://access.redhat.com/errata/RHSA-2026:5633 ADVISORY https://access.redhat.com/errata/RHSA-2026:5636 ADVISORY https://github.com/remix-run/react-router/security/advisories/GHSA-2w69-qvjg-hvjx ADVISORY https://vuldb.com/vuln/340411 REF https://access.redhat.com/errata/RHSA-2026:13542 REF https://access.redhat.com/errata/RHSA-2026:13548 REF https://access.redhat.com/errata/RHSA-2026:17468 REF https://access.redhat.com/errata/RHSA-2026:17469 REF https://access.redhat.com/errata/RHSA-2026:17474 REF https://access.redhat.com/errata/RHSA-2026:19712 REF https://access.redhat.com/errata/RHSA-2026:20041 REF https://access.redhat.com/errata/RHSA-2026:20042 REF https://access.redhat.com/errata/RHSA-2026:21658 REF https://access.redhat.com/errata/RHSA-2026:26413 REF https://access.redhat.com/errata/RHSA-2026:26420 REF https://access.redhat.com/errata/RHSA-2026:34100 REF https://access.redhat.com/errata/RHSA-2026:36651 REF https://access.redhat.com/errata/RHSA-2026:36882 REF https://access.redhat.com/errata/RHSA-2026:40118 REF https://access.redhat.com/errata/RHSA-2026:40138 REF https://access.redhat.com/errata/RHSA-2026:40945 REF https://access.redhat.com/errata/RHSA-2026:40984 REF https://access.redhat.com/errata/RHSA-2026:41064 REF https://access.redhat.com/errata/RHSA-2026:41928 REF https://access.redhat.com/errata/RHSA-2026:8218 REF https://access.redhat.com/errata/RHSA-2026:8229 REF https://access.redhat.com/errata/RHSA-2026:9848 REF https://access.redhat.com/security/cve/CVE-2026-22029 REF https://bugzilla.redhat.com/show_bug.cgi?id=2428412 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22029.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy