React Router versions 7.0.0 through 7.11.0 and @remix-run/react versions prior to 2.17.3 contain a cross-site scripting vulnerability in the <ScrollRestoration> API when operating in Framework Mode with server-side rendering. This vulnerability arises from improper neutralization of input used in the getKey/storageKey properties, which can lead to arbitrary JavaScript execution during SSR if untrusted content is used to generate these keys. The vulnerability does not affect applications that disable SSR in Framework Mode or use Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). The issue has been addressed and fixed in react-router version 7.12.0 and @remix-run/react version 2.17.3.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code during server-side rendering in Framework Mode, potentially leading to client-side script injection and compromise of user interactions or data. The vulnerability has a CVSS 3.1 base score of 8.2, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope change, high confidentiality impact, low integrity impact, and no availability impact. There are no known exploits in the wild at this time.

This vulnerability has been officially fixed in react-router version 7.12.0 and @remix-run/react version 2.17.3. Users should upgrade to these versions or later to remediate the issue. If server-side rendering in Framework Mode is disabled, or if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is used, there is no impact. No additional mitigations are required beyond applying the official patches.