React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<BrowserRouter>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.
References
Configurations
History
21 Jul 2026, 12:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
20 Jul 2026, 12:18
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
17 Jul 2026, 13:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
16 Jul 2026, 12:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
10 Jul 2026, 12:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
09 Jul 2026, 13:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
30 Jun 2026, 03:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
02 Jun 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
|
| Summary | (en) React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<BrowserRouter>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0. |
10 Feb 2026, 19:36
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/remix-run/react-router/security/advisories/GHSA-2w69-qvjg-hvjx - Vendor Advisory | |
| CPE | cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:* cpe:2.3:a:shopify:remix-run\/react:*:*:*:*:*:node.js:*:* |
|
| First Time |
Shopify
Shopify react-router Shopify remix-run\/react |
10 Jan 2026, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-10 03:15
Updated : 2026-07-21 12:17
NVD link : CVE-2026-22029
Mitre link : CVE-2026-22029
CVE.ORG link : CVE-2026-22029
JSON object : View
Products Affected
shopify
- react-router
- remix-run\/react
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
