Skip to content
Heist/ feed
Back to feed
High

React Router vulnerable to XSS via Open Redirects

Type: advisorySources: OSV

React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode () is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-22029
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 03:57 UTC · Revision 1

Source evidence

React Router vulnerable to XSS via Open Redirects

core-osv · Original source

Published 10 Jan 2026, 02:42 UTC

React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode () is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.

osv:CVE-2026-22029
Complete source record
{
  "id": "e9308358d5d9bc6309041390738166261026f94d1d6e645aebcc5e0f2801a3c6",
  "url": "https://osv.dev/vulnerability/CVE-2026-22029",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "React Router vulnerable to XSS via Open Redirects",
    "summary": "React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode () is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.",
    "evidence": "osv:CVE-2026-22029",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-22029",
      "aliases": [
        "CVE-2026-22029",
        "GHSA-2w69-qvjg-hvjx"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/remix-run/react-router",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "c662ca366a414bf42624dd6cd20a7c414b2602e3"
                },
                {
                  "introduced": "e8e3b004d94a949372e77ce97a543bff5bc6fb89"
                },
                {
                  "last_affected": "b34a9cd1f74231ded97c1e6ca9dff8f09a1b87ca"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:shopify:remix-run\\/react:*:*:*:*:*:node.js:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.23.2"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:*",
                    "range": [
                      {
                        "introduced": "7.0.0"
                      },
                      {
                        "last_affected": "7.11.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "react-router@6.30.3-pre-v6.0",
            "react-router-native@6.30.3-pre-v6.0",
            "react-router-dom@6.30.3-pre-v6.0",
            "react-router-dom-v5-compat@6.30.3-pre-v6.0",
            "@remix-run/router@1.23.2-pre-v6.0",
            "react-router@7.11.0",
            "react-router-dom@7.11.0",
            "create-react-router@7.11.0",
            "@react-router/serve@7.11.0",
            "@react-router/remix-routes-option-adapter@7.11.0",
            "@react-router/node@7.11.0",
            "@react-router/fs-routes@7.11.0",
            "@react-router/express@7.11.0",
            "@react-router/dev@7.11.0",
            "@react-router/cloudflare@7.11.0",
            "@react-router/architect@7.11.0",
            "react-router@6.28.0-pre.0",
            "react-router-native@6.28.0-pre.0",
            "react-router-dom@6.28.0-pre.0",
            "react-router-dom-v5-compat@6.28.0-pre.0",
            "@remix-run/router@1.21.0-pre.0",
            "react-router@6.4.2",
            "react-router-native@6.4.2",
            "react-router-dom@6.4.2",
            "react-router-dom-v5-compat@6.4.2",
            "@remix-run/router@1.0.2",
            "react-router@6.4.2-pre.1",
            "react-router-native@6.4.2-pre.1",
            "react-router-dom@6.4.2-pre.1",
            "react-router-dom-v5-compat@6.4.2-pre.1",
            "react-router@6.4.1",
            "react-router-native@6.4.1",
            "react-router-dom@6.4.1",
            "react-router-dom-v5-compat@6.4.1",
            "@remix-run/router@1.0.1",
            "react-router@6.4.1-pre.0",
            "react-router-native@6.4.1-pre.0",
            "react-router-dom@6.4.1-pre.0",
            "react-router-dom-v5-compat@6.4.1-pre.0",
            "@remix-run/router@1.0.1-pre.0",
            "react-router@6.4.0-pre.8",
            "react-router-native@6.4.0-pre.8",
            "react-router-dom@6.4.0-pre.8",
            "react-router-dom-v5-compat@6.4.0-pre.8",
            "@remix-run/router@0.2.0-pre.3",
            "v6.2.2",
            "v6.2.2-pre.0",
            "v6.2.1",
            "v6.2.0",
            "v6.1.0",
            "v6.0.1",
            "v6.0.0-beta.8",
            "v6.0.0-beta.6",
            "v6.0.0-beta.4",
            "v6.0.0-beta.3",
            "v6.0.0-beta.2",
            "v6.0.0-beta.1",
            "v6.0.0-beta.0",
            "v6.0.0-alpha.5",
            "v6.0.0-alpha.4",
            "v6.0.0-alpha.3",
            "v6.0.0-alpha.2",
            "v6.0.0-alpha.1",
            "v6.0.0-alpha.0",
            "v5.1.1",
            "v5.1.0",
            "v5.0.1",
            "v5.0.0",
            "v4.4.0",
            "v4.4.0-beta.8",
            "v4.4.0-beta.7",
            "v4.4.0-beta.6",
            "v4.4.0-beta.5",
            "v4.4.0-beta.4",
            "v4.4.0-beta.3",
            "v4.4.0-beta.2",
            "v4.4.0-beta.1",
            "v4.4.0-beta.0",
            "v4.3.1",
            "v4.3.0",
            "v4.3.0-rc.3",
            "v4.3.0-rc.2",
            "v4.3.0-rc.1",
            "v4.2.2",
            "v4.2.1",
            "v4.2.0",
            "v4.1.1",
            "v4.1.0",
            "v4.0.0",
            "v3.0.2",
            "v3.0.1",
            "v3.0.0",
            "v3.0.0-beta.1",
            "v3.0.0-alpha.3",
            "v3.0.0-alpha.2",
            "v3.0.0-alpha.1",
            "v2.2.4",
            "v2.2.3",
            "v2.2.2",
            "v2.2.1",
            "v2.2.0",
            "v2.1.1",
            "v2.1.0",
            "v2.0.1",
            "v2.0.0",
            "v2.0.0-rc6",
            "v2.0.0-rc5",
            "v2.0.0-rc4",
            "v2.0.0-rc3",
            "v2.0.0-rc2",
            "v2.0.0-rc1",
            "v1.0.1",
            "v1.0.0",
            "v1.0.0-rc4",
            "v1.0.0-rc3",
            "v1.0.0-rc2",
            "v1.0.0-rc1",
            "v1.0.0-beta4",
            "v0.13.3",
            "v1.0.0-beta3",
            "v1.0.0-beta2",
            "v1.0.0-alpha2",
            "v0.13.2",
            "v0.13.1",
            "v0.13.0",
            "v0.12.4",
            "v0.12.3",
            "v0.12.2",
            "v0.12.1",
            "v0.12.0",
            "v0.11.6",
            "v0.11.5",
            "v0.11.3",
            "v0.11.4",
            "v0.11.2",
            "v0.11.1",
            "v0.11.0",
            "v0.10.2",
            "v0.10.1",
            "v0.10.0",
            "v0.9.5",
            "v0.9.4",
            "v0.9.3",
            "v0.9.2",
            "v0.9.1",
            "v0.9.0",
            "v0.8.0",
            "v0.7.0",
            "v0.6.1",
            "v0.6.0",
            "v0.5.3",
            "v0.5.2",
            "v0.5.1",
            "v0.5.0",
            "v0.4.2",
            "v0.4.1",
            "v0.4.0",
            "v0.3.5",
            "v0.3.4",
            "v0.3.2",
            "v0.3.1",
            "v0.3.0",
            "v0.2.1",
            "v0.2.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22029.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:25.768909670Z",
      "provider": "osv",
      "references": [
        "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22029.json",
        "https://access.redhat.com/errata/RHSA-2026:13542",
        "https://access.redhat.com/errata/RHSA-2026:13548",
        "https://access.redhat.com/errata/RHSA-2026:1517",
        "https://access.redhat.com/errata/RHSA-2026:17468",
        "https://access.redhat.com/errata/RHSA-2026:17469",
        "https://access.redhat.com/errata/RHSA-2026:17474",
        "https://access.redhat.com/errata/RHSA-2026:19712",
        "https://access.redhat.com/errata/RHSA-2026:20041",
        "https://access.redhat.com/errata/RHSA-2026:20042",
        "https://access.redhat.com/errata/RHSA-2026:2147",
        "https://access.redhat.com/errata/RHSA-2026:2148",
        "https://access.redhat.com/errata/RHSA-2026:2149",
        "https://access.redhat.com/errata/RHSA-2026:21658",
        "https://access.redhat.com/errata/RHSA-2026:2350",
        "https://access.redhat.com/errata/RHSA-2026:2456",
        "https://access.redhat.com/errata/RHSA-2026:2568",
        "https://access.redhat.com/errata/RHSA-2026:2572",
        "https://access.redhat.com/errata/RHSA-2026:26413",
        "https://access.redhat.com/errata/RHSA-2026:26420",
        "https://access.redhat.com/errata/RHSA-2026:2694",
        "https://access.redhat.com/errata/RHSA-2026:3087",
        "https://access.redhat.com/errata/RHSA-2026:34100",
        "https://access.redhat.com/errata/RHSA-2026:36651",
        "https://access.redhat.com/errata/RHSA-2026:36882",
        "https://access.redhat.com/errata/RHSA-2026:3782",
        "https://access.redhat.com/errata/RHSA-2026:3958",
        "https://access.redhat.com/errata/RHSA-2026:3959",
        "https://access.redhat.com/errata/RHSA-2026:3960",
        "https://access.redhat.com/errata/RHSA-2026:40118",
        "https://access.redhat.com/errata/RHSA-2026:40945",
        "https://access.redhat.com/errata/RHSA-2026:40984",
        "https://access.redhat.com/errata/RHSA-2026:41064",
        "https://access.redhat.com/errata/RHSA-2026:41928",
        "https://access.redhat.com/errata/RHSA-2026:5633",
        "https://access.redhat.com/errata/RHSA-2026:5636",
        "https://access.redhat.com/errata/RHSA-2026:8218",
        "https://access.redhat.com/errata/RHSA-2026:8229",
        "https://access.redhat.com/errata/RHSA-2026:9848",
        "https://access.redhat.com/security/cve/CVE-2026-22029",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22029.json",
        "https://github.com/remix-run/react-router/security/advisories/GHSA-2w69-qvjg-hvjx",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-22029",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2428412"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-79"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22029.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-22029",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 492311,
  "published_at": "2026-01-10T02:42:32.736+00:00"
}