React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/remix-run/react-router/commit/3a5b5ad0e5cf9918c646509563f5c41a89226ff3 Patch
- https://github.com/remix-run/react-router/pull/14718 Issue Tracking, Patch
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.9 · shopifyNVD modified 2026-10-24 13:10
Affected (CPE criteria) 1
cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:*
References 5
- https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180 Release Notes
- https://github.com/remix-run/react-router/commit/3a5b5ad0e5cf9918c646509563f5c41a89226ff3 Patch
- https://github.com/remix-run/react-router/pull/14718 Issue Tracking, Patch
- https://github.com/remix-run/react-router/releases/tag/[email protected] Release Notes
- https://github.com/remix-run/react-router/security/advisories/GHSA-jjmj-jmhj-qwj2 Third Party Advisory