# CVE-2026-22029: React Router vulnerable to XSS via Open Redirects

> CVE-2026-22029: React Router vulnerable to XSS via Open Redirects. CVSS 8.0 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-22029
Last updated: 2026-09-10T13:17:42Z

- Published: 2026-01-10 02:42 UTC · Updated: 2026-09-10 13:17 UTC · Assigner: GitHub\_M
- CVSS: 8.0 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
- EPSS: 0.87%, 58th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-79

## Description

React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (\<BrowserRouter\>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.

## Affected vendors and products

- Red Hat: Cryostat 4
- Red Hat: Gatekeeper 3
- Red Hat: Logging Subsystem for Red Hat OpenShift
- Red Hat: Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat: Red Hat Advanced Cluster Security 4
- Red Hat: Red Hat Ansible Automation Platform 2
- Red Hat: Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat: Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat: Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat: Red Hat build of Apache Camel - HawtIO 4
- Red Hat: Red Hat Build of Kueue
- Red Hat: Red Hat Connectivity Link 1
- Red Hat: Red Hat Data Grid 8
- Red Hat: Red Hat Edge Manager preview
- Red Hat: Red Hat Fuse 7
- Red Hat: Red Hat JBoss Enterprise Application Platform 8
- Red Hat: Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat: Red Hat OpenShift Virtualization 4
- Red Hat: Red Hat Process Automation 7
- remix-run: react-router
- remix-run: @remix-run/router

## Tracked companies

- [Confluence](https://rewindex.com/company/confluence.md)
- [Jira](https://rewindex.com/company/jira.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-22029)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-22029)
- [https://github.com/remix-run/react-router/security/advisories/GHSA-2w69-qvjg-hvjx](https://github.com/remix-run/react-router/security/advisories/GHSA-2w69-qvjg-hvjx)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-22029 · Markdown: https://rewindex.com/cve/CVE-2026-22029.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-22029 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:15:12.309Z