CVE-2026-22029: React Router vulnerable to XSS via Open Redirects
Description
React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<BrowserRouter>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N · CWE-79
Tracked companies
Mapped from the CVE’s affected-product data, NVD CPE matches, vendor advisories or package feeds. A mapping means the vendor’s software is named, not that its hosted service was exposed.
Status incidents that name it
No tracked status incident names this CVE.
Affected vendors and products
Red Hat: Cryostat 4Red Hat: Gatekeeper 3Red Hat: Logging Subsystem for Red Hat OpenShiftRed Hat: Red Hat Advanced Cluster Management for Kubernetes 2Red Hat: Red Hat Advanced Cluster Security 4Red Hat: Red Hat Ansible Automation Platform 2Red Hat: Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat: Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat: Red Hat Ansible Automation Platform 2.6 for RHEL 9Red Hat: Red Hat build of Apache Camel - HawtIO 4Red Hat: Red Hat Build of KueueRed Hat: Red Hat Connectivity Link 1Red Hat: Red Hat Data Grid 8Red Hat: Red Hat Edge Manager previewRed Hat: Red Hat Fuse 7Red Hat: Red Hat JBoss Enterprise Application Platform 8Red Hat: Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat: Red Hat OpenShift Virtualization 4Red Hat: Red Hat Process Automation 7remix-run: react-routerremix-run: @remix-run/router
References
- CVE record on cve.org (opens in new tab)
- NVD entry (opens in new tab)
- github.com/remix-run/react-router/security/advisories/GHSA-2w69-qvjg-hvjx (opens in new tab)
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)