Linux Distros Unpatched Vulnerability : CVE-2026-55685

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would p...

MAL-2026-11427 Malicious code in pp-react-worldready (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cd3313519c0ef5edb290227d7d183c3d5344473351bc10bcf6a5d09e51c32a7 package.json declares a preinstall hook that runs vishu.js on npm install. The script resolves the installer's public IP via api.ipify.org, reads...

Malicious code in pp-react-worldready (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cd3313519c0ef5edb290227d7d183c3d5344473351bc10bcf6a5d09e51c32a7 package.json declares a preinstall hook that runs vishu.js on npm install. The script resolves the installer's public IP via api.ipify.org, reads...

React Server Components - Remote Code Execution

React Server Components 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack contain a remote code execution caused by unsafe deserialization of payloads from HTTP requests to Server Function endpoints, letting...

The vulnerability of React Router’s routing library in React applications stems from the redirection of URLs to unreliable websites, allowing attackers to carry out phishing attacks.

The vulnerability of the React Router routing library for React applications relates to the redirection of URLs to unreliable websites. Exploiting this vulnerability allows a remote attacker to carry out phishing attacks...

CVE-2026-18245

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...

CVE-2026-18245 Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...

react-router: React Router: Open Redirect vulnerability via backslashes in navigation components

A flaw was found in React Router, a routing library for React applications. A remote attacker could exploit this vulnerability by crafting a malicious link that uses backslashes within the or useNavigate components. This could lead to an Open Redirect, allowing the attacker to redirect users to...

react-router: React Router: Open Redirect vulnerability via backslashes in navigation components

A flaw was found in React Router, a routing library for React applications. A remote attacker could exploit this vulnerability by crafting a malicious link that uses backslashes within the or useNavigate components. This could lead to an Open Redirect, allowing the attacker to redirect users to...

Malicious code in react-fast-refresh-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcca3ccc0a35a13d8b3f30ff6019ab57782882ada4e01b941fbee77ad1236115 Package typosquats a React/Meta-branded name and falsely attributes authorship to 'Meta Open Source'. Its package.json declares a postinstall hook...

MAL-2026-11366 Malicious code in react-fast-refresh-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcca3ccc0a35a13d8b3f30ff6019ab57782882ada4e01b941fbee77ad1236115 Package typosquats a React/Meta-branded name and falsely attributes authorship to 'Meta Open Source'. Its package.json declares a postinstall hook...

CVE-2026-55685

A flaw was found in React Router. An unauthenticated attacker can send targeted requests to the manifest endpoint, leading to a denial of service DoS. This can put a heavy load on the server, significantly slowing down response times and impacting the availability of the application. Mitigation...

MAL-2026-11144 Malicious code in react-puller (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3ac07c0f6c79714a7b1f6bfd1272f9f7942cf0473875ca5276a1034c084f06d The package's postinstall hook runs node index.js, which spawns a detached worker that downloads two Windows executables CDPUserPlatform.exe and...

CVE-2026-53667

A flaw was found in React Router. The RSCErrorHandler component, used in applications leveraging unstable React Server Components RSC Application Programming Interfaces APIs, is missing crucial protocol validation. This vulnerability allows an attacker to redirect users to untrusted external...

CVE-2026-53668

A flaw was found in React Router. Applications using React Router that allow open redirects are vulnerable to Cross-Site Scripting XSS. A remote attacker could craft a malicious link that, when clicked by a user, redirects them to an unexpected external site or exploits an XSS vulnerability,...

CVE-2026-53666

A flaw was found in React Router. If an application is configured to allow attacker-supplied input to modify errors during server-side rendering SSR, a remote attacker could trigger unexpected code execution on the client. This execution could lead to an outbound network request, potentially...

CVE-2026-53669

A flaw was found in React Router, a routing library for React applications. A remote attacker could exploit this vulnerability by crafting a malicious link that uses backslashes within the or useNavigate components. This could lead to an Open Redirect, allowing the attacker to redirect users to...

Linux Distros Unpatched Vulnerability : CVE-2026-53666

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite...

Linux Distros Unpatched Vulnerability : CVE-2026-53669

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in and useNavigate. This issue is ...

DoS (Denial of Service) react-router Dependency in Jira Service Management Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.3.8, 10.7.1, 11.0.0, and 11.1.0 of Jira Service Management Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...