React Router and @remix-run/router versions prior to 1.23.2 and react-router versions 7.0.0 through 7.11.0 contain a cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or unstable RSC modes can produce unsafe URLs that lead to unintended JavaScript execution on the client side. This vulnerability is exploitable only when redirect paths are constructed from untrusted input or open redirects. Declarative Mode (<BrowserRouter>) is not affected. The issue has been patched in @remix-run/router 1.23.2 and react-router 7.12.0. The CVSS v3.1 base score is 8.0, indicating high severity, with network attack vector, high attack complexity, no privileges required, user interaction required, and scope changed. The impact includes high confidentiality and integrity loss but no availability impact. Red Hat advisories confirm the vulnerability and note that mitigation options are limited outside of upgrading to fixed versions.

Successful exploitation of this vulnerability can lead to execution of unauthorized JavaScript code in the context of the affected web application, potentially allowing attackers to steal sensitive information such as session cookies, manipulate application data, or perform actions on behalf of users. The vulnerability affects confidentiality and integrity of user data but does not impact availability. The risk is significant if redirect paths are created from untrusted sources or open redirects are present. Applications using Declarative Mode (<BrowserRouter>) are not impacted. There are no known exploits in the wild at this time.

A fix is available and users are strongly advised to upgrade to @remix-run/router version 1.23.2 or later and react-router version 7.12.0 or later. Red Hat advisories indicate that mitigation options other than upgrading do not meet their criteria for ease of use and applicability. Therefore, upgrading to the fixed versions is the recommended remediation. If upgrading is not immediately possible, avoid creating redirect paths from untrusted content or open redirects to reduce exposure.