React Router and @remix-run/router versions prior to 1.23.2 and react-router versions 7.0.0 through 7.11.0 contain a cross-site scripting vulnerability (CWE-79) caused by improper neutralization of input during web page generation. Specifically, open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or unstable RSC modes can produce unsafe URLs that lead to unintended JavaScript execution on the client. This vulnerability requires that redirect paths be constructed from untrusted content or involve an open redirect. Declarative Mode (<BrowserRouter>) is not affected. The issue is fixed in @remix-run/router 1.23.2 and react-router 7.12.0. Red Hat has issued security advisories and updates for OpenShift Container Platform 4.21.16 to address this vulnerability. The CVSS v3.1 base score is 8.0 (high severity) with network attack vector, high attack complexity, no privileges required, user interaction required, and scope changed. The impact includes potential confidentiality and integrity loss through unauthorized code execution and data disclosure.

Successful exploitation of this vulnerability can lead to cross-site scripting attacks, allowing attackers to execute arbitrary JavaScript in the context of the affected web application. This can result in disclosure of sensitive information such as user cookies and session data, unauthorized actions performed on behalf of users, and potential compromise of user accounts. The vulnerability affects confidentiality and integrity but does not impact availability. It requires user interaction and high attack complexity, limiting ease of exploitation. There are no known active exploits in the wild at this time.

A fix is available and has been released in @remix-run/router version 1.23.2 and react-router version 7.12.0. Users are strongly advised to upgrade to these or later versions to remediate the vulnerability. Red Hat OpenShift Container Platform 4.21 users should upgrade to version 4.21.16 or later, which includes the patched packages and container images. No alternative mitigations meeting Red Hat's criteria for ease of use and applicability are currently available. Users should avoid creating redirect paths from untrusted content or open redirects as a temporary measure. Refer to the vendor advisories for detailed upgrade instructions.