CVE-2026-21884

HighCVSS 8.2/10Last modified Jul 15, 2026

Description

React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. There is no impact if server-side rendering in Framework Mode is disabled, or if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/react version 2.17.3 and react-router version 7.12.0.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
remix-run	react-router	@remix-run/react < 2.17.3; react-router >= 7.0.0, < 7.12.0
Red Hat	Red Hat Ansible Automation Platform 2.6 for RHEL 9	—
Red Hat	Red Hat Ansible Automation Platform 2.6	—
Red Hat	Red Hat OpenShift AI 2.25	—
Red Hat	Red Hat OpenShift AI 2.25	—
Red Hat	Red Hat OpenShift AI 3.3	—
Red Hat	Red Hat OpenShift AI 3.3	—
Red Hat	Red Hat OpenShift AI 3.3	—
Red Hat	Red Hat Build of Kueue	—
Red Hat	Red Hat Build of Kueue	—
Red Hat	Red Hat Build of Kueue	—
Red Hat	Red Hat Build of Kueue	—
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 9	—

References

Timeline

Published: Jan 10, 2026
Last modified: Jul 15, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-218856.5Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}CVE-2026-218868.1OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mut CVE-2026-218877.7OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.8.16, the OpenCTI platform’s CVE-2026-218887.5NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. MQTT v5 Variable Byte Integer parsing out-of-bounds: get_var_integer()CVE-2026-218897.5Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper acce CVE-2026-21899.8A vulnerability was identified in itsourcecode School Management System 1.0. This affects an unknown function of the file /ramonsys/report/i CVE-2026-218919.8ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions up to and including 1.5.0, the ap CVE-2026-218927.3Parsl is a Python parallel scripting library. A SQL Injection vulnerability exists in the parsl-visualize component of versions prior to 202 CVE-2026-218937.2n8n is an open source workflow automation platform. From version 0.187.0 to before 1.120.3, a command injection vulnerability was identified CVE-2026-218946.5n8n is an open source workflow automation platform. In versions from 0.150.0 to before 2.2.2, an authentication bypass vulnerability in the CVE-2026-218955.3The `rsa` crate is an RSA implementation written in rust. Prior to version 0.9.10, when creating a RSA private key from its components, the CVE-2026-218965.7Kirby is an open-source content management system. From versions 5.0.0 to 5.2.1, Kirby is missing permission checks in the content changes A