8.2
High
CVE-2026-21884 React Router is a router for React
Description
React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. There is no impact if server-side rendering in Framework Mode is disabled, or if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/react version 2.17.3 and react-router version 7.12.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| react-router | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 1772543959 | earliest → < 1772543959 | 1772543959 |
| Red Hat OpenShift AI 2.25 1772093498 | earliest → < 1772093498 | 1772093498 |
| Red Hat OpenShift AI 3.3 1778666987 | earliest → < 1778666987 | 1778666987 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 10 | Versions not published | |
| Red Hat Build of Kueue | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published |
References
- github.com github.com
Timeline
- Published
- Last modified