CVE-2026-22029
Open Redirect in React Router Causes Unsafe Client-Side Script Execution
Publication date: 2026-01-10
Last updated on: 2026-02-10
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| shopify | remix-run/react | to 1.23.2 (exc) |
| shopify | react-router | From 7.0.0 (inc) to 7.11.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-22029 is a high-severity cross-site scripting (XSS) vulnerability in React Router and Remix single-page applications. It occurs when open navigation redirects are created from loaders or actions in Framework Mode, Data Mode, or unstable React Server Components modes using versions of @remix-run/router prior to 1.23.2 and react-router versions 7.0.0 through 7.11.0. If redirect paths are constructed from untrusted input or via open redirects, this can lead to unsafe URLs that cause unintended JavaScript execution on the client side. This vulnerability does not affect applications using Declarative Mode (such as <BrowserRouter>). The issue was fixed in @remix-run/router 1.23.2 and react-router 7.12.0. [1]
How can this vulnerability impact me? :
This vulnerability can lead to cross-site scripting (XSS) attacks, allowing attackers to execute malicious JavaScript in users' browsers. This can compromise the confidentiality and integrity of user data, potentially leading to theft of sensitive information, session hijacking, or unauthorized actions performed on behalf of the user. The CVSS score indicates high impact on confidentiality and integrity, though availability is not affected. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves identifying if your application uses vulnerable versions of @remix-run/router (≤1.23.1) or react-router (≥7.0.0 and ≤7.11.0) and if it creates open navigation redirects from untrusted input in Framework Mode, Data Mode, or unstable RSC modes. You can check your installed package versions with commands like `npm list @remix-run/router` or `npm list react-router`. Additionally, testing for open redirects and potential XSS by attempting to inject JavaScript payloads in redirect parameters may help detect exploitation. There are no specific commands provided for network detection in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade @remix-run/router to version 1.23.2 or later, and react-router to version 7.12.0 or later, where the vulnerability has been patched. Also, avoid creating redirect paths from untrusted content or open redirects, and consider using Declarative Mode (e.g., <BrowserRouter>) which is not affected by this issue. [1]