8.2
Élevée
CVE-2026-21884 React Router is a router for React
Description
React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. There is no impact if server-side rendering in Framework Mode is disabled, or if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/react version 2.17.3 and react-router version 7.12.0.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| react-router | Versions non publiées | |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Versions non publiées | |
| Red Hat Ansible Automation Platform 2.6 1772543959 | premières → < 1772543959 | 1772543959 |
| Red Hat OpenShift AI 2.25 1772093498 | premières → < 1772093498 | 1772093498 |
| Red Hat OpenShift AI 3.3 1778666987 | premières → < 1778666987 | 1778666987 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 10 | Versions non publiées | |
| Red Hat Build of Kueue | Versions non publiées | |
| Red Hat Enterprise Linux 10 | Versions non publiées | |
| Red Hat Enterprise Linux 9 | Versions non publiées |
Références
- github.com github.com
Chronologie
- Publiée
- Dernière modification