CVE-2026-22029

React Router vulnerable to XSS via Open Redirects

MEDIUM

6.1

CVSS Score

Published: January 10, 2026 at 02:42 AM UTC

Updated: September 10, 2026 at 01:17 PM UTC

25 products affected across 3 vendorsReact RouterRemix Run /reactOpenShift Container Platform

Using react-router by remix-run?

Get instant alerts when new vulnerabilities affect react-router - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.1

Exploit prediction

EPSS 0.9%

SSVC

No known exploit

Description

React Router is a router for React. In @remix-run/router version prior to 1.23.2. and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<BrowserRouter>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

React Router · Shopifynpm

95%

7.0.0 ≤ v ≤ 7.11.0

Remix Run /react · Shopify

95%

v < 1.23.2

Affected range stops below 1.23.2, so it looks safe — our inference, not a vendor statement

Advanced Cluster Management for Kubernetes · Red Hatcontainer

60%

Vendor states this is fixed in 1769990632 (unaffected)

Vendor states this is fixed in 1773259174 (unaffected)

Vendor states this is fixed in 1775116130 (unaffected)

Vendor states this is fixed in 1776927126 (unaffected)

Vendor states this is fixed in 1782693386 (unaffected)

Vendor states this is fixed in 1783350952 (unaffected)

Ansible Automation Platform · Red Hatrpm

60%

Vendor states this is fixed in 0:2.5.20260225-1.el8ap (unaffected)

Vendor states this is fixed in 0:2.5.20260225-1.el9ap (unaffected)

Vendor states this is fixed in 0:2.6.6-1.el9ap (unaffected)

Vendor states this is fixed in 1772543959 (unaffected)

Vendor states this is fixed in 2 (unaffected)

Build of Apicurio Registry · Red Hatrpm

60%

Connectivity Link · Red Hatcontainer

60%

Data Grid · Red Hatrpm

60%

Developer Hub · Red Hatrpm

60%

All versions

Edge Manager · Red Hatrpm

60%

All versions

Vendor states this is fixed in 1783502438 (unaffected)

Vendor states this is fixed in 1783502765 (unaffected)

Vendor states this is fixed in 1784126822 (unaffected)

Vendor states this is fixed in 1784127736 (unaffected)

Vendor states this is fixed in 1784194574 (unaffected)

Vendor states this is fixed in 1784194938 (unaffected)

Fuse · Red Hatrpm

60%

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://github.com/remix-run/react-router/security/advisories/GHSA-2w69-qvjg-hvjx