React Router vulnerabilities

In React Router and Remix Run libraries, a vulnerability allows reading/writing session files outside the specified directory when using createFileSessionStorage() with an unsigned cookie. An attacker can cause the session to access locations outside the intended session file directory, depending on web server process permissions.

Vulnerability in React Router versions 7.0.0 through 7.17.0. Unauthenticated requests to the manifest endpoint can overload the server and slow down responses. This does not affect applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).

React Router versions 6.0.0 through 7.17.0 are vulnerable to Open Redirect through use of backslashes in <Link> and useNavigate. This issue has been fixed in version 7.18.0.

React Router versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0 are vulnerable to XSS in applications that allow open redirects. An attacker could craft a malicious link that redirects users to an unexpected external site or exploits an XSS vector. This issue has been fixed in version 7.13.0.

React Router versions 7.11.0 through 7.17.0 are missing protocol validation in RSCErrorHandler, allowing redirects from untrusted sources. This only affects applications using unstable RSC APIs. Fixed in version 7.18.0.

React Router versions 6.4.0 through 7.17.0 allow unexpected constructor execution on the client if application code allows attacker-supplied input to overwrite certain aspects of SSR errors. This can trigger an outbound network request. Only affects Framework Mode and Data Mode applications performing manual SSR/hydration. Fixed in version 7.18.0.

React Router versions from 7.12.0 to 7.15.1 had insufficient CSRF checks in Framework Mode that operated on POST requests but were bypassed on PUT/PATCH/DELETE requests. This vulnerability is fixed in version 7.15.1.

React Router versions 7.0.0 through 7.14.x and @remix-run/server-runtime versions 2.10.0 through 2.17.4 contain a DoS vulnerability via unbounded path expansion in the __manifest endpoint. Attackers can send crafted requests that consume excessive server resources.

React Router versions 7.0.0 through 7.14.1 in Framework Mode can allow remote code execution (RCE) via external requests if the application has an existing prototype pollution vulnerability. Two-step attack. Does not affect Declarative or Data Mode.

React Router versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3 contain an open redirect vulnerability where certain URLs passed to the redirect function can be reinterpreted as protocol-relative URLs, redirecting to an external domain.

Client-side Cross-Site Scripting (XSS) vulnerability in React Router versions 7.7.0 through 7.13.1, occurring during RSC redirect handling from untrusted sources. Only affects applications using unstable RSC APIs.

React Router versions 7.7.0 through 7.13.1 contain a client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This only affects applications using the unstable RSC APIs. Patched in version 7.13.2.

React Router versions 7.5.1 through 7.13.1 in Framework Mode with pre-rendering enabled improperly neutralize the HTTP Location header, allowing XSS in static HTML files if the redirect source is untrusted. Not affected in Declarative or Data Mode. Patched in version 7.13.2.

In @remix-run/router before 1.23.2 and react-router 7.0.0-7.11.0, SPA open navigation redirects from loaders/actions in Framework, Data, or RSC modes can result in unsafe URLs causing unintended JavaScript execution on the client. This is only an issue when creating redirect paths from untrusted content or via an open redirect.

XSS vulnerability in React Router's <ScrollRestoration> API in Framework Mode during Server-Side Rendering when using getKey/storageKey props. It allows arbitrary JavaScript execution during SSR if untrusted content is used to generate keys.

In React Router versions @remix-run/react 1.15.0-2.17.0 and react-router 7.0.0-7.8.2, an XSS vulnerability exists in the meta()/<Meta> APIs in Framework Mode. It allows arbitrary JavaScript execution during SSR when untrusted content is used to generate script:ld+json tags.