Log in Start free

Vulnerability · Published Jan 10, 2026 · Assigned by GitHub_M

CVE-2026-22029React Router vulnerable to XSS via Open Redirects

High 8.0

In plain English

A high-severity cross-site scripting in react-router from remix-run. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.0High
Exploit odds (30 days)0.9%top 41.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<BrowserRouter>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@remix-run/router1.23.2GHSA-2w69-qvjg-hvjx
npmreact-router7.12.0GHSA-2w69-qvjg-hvjx

Affected products (as reported)

VendorProductVersions
remix-run react-router >= 7.0.0, < 7.12.0
remix-run @remix-run/router < 1.23.2

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

References