CVE-2026-42211 is a remote code execution vulnerability in React Router versions 7.0.0 through 7.14.1 when operating in Framework Mode. The flaw is due to prototype pollution within the application code, enabling an attacker to perform a two-step attack that leads to unauthorized remote code execution on the server. Red Hat's Trusted Artifact Signer (RHTAS) Operator, used with OpenShift Container Platform 4.16 to 4.21, includes this vulnerable component. Red Hat products using React Router in Declarative Mode or Data Mode are not impacted. The vulnerability is rated high severity by Red Hat. No patch or fix has been released yet. The recommended mitigation is to avoid Framework Mode and use Declarative or Data Mode instead.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the affected server, leading to full system compromise. This impacts the integrity, confidentiality, and availability of the system. The vulnerability specifically affects React Router in Framework Mode, which is used in Red Hat Trusted Artifact Signer deployments integrated with OpenShift Container Platform versions 4.16 through 4.21. No known exploits are currently reported in the wild.

Red Hat has not released an official patch or fix for this vulnerability as of the advisory date. To mitigate the risk, users should ensure that applications using React Router are not configured in Framework Mode. Instead, applications should use Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>), which are not vulnerable to this flaw. Follow Red Hat's product documentation and advisories for updates and further guidance.