0beny1s (1.1.6), 0desgin (0.0.1) +15142 more potentially affected by CVE-2026-53666 via react-router (>=6.4.0, <=7.17.0)

react-router NPM version =6.4.0, =7.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on react-router and may be impacted: - 0beny1s 1.1.6 - 0desgin 0.0.1 - 0scarclassa 1.0.1 - 0scarclassb 1.0.1 - 0scarclassc 1.0.1 - 0scarclassd 1.0.1 - 0scarclasse 1.0...

0beny1s (1.1.6), 0desgin (0.0.1) +15142 more potentially affected by CVE-2026-53666 via react-router (>=6.4.0, <=7.17.0)

react-router NPM version =6.4.0, =7.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on react-router and may be impacted: - 0beny1s 1.1.6 - 0desgin 0.0.1 - 0scarclassa 1.0.1 - 0scarclassb 1.0.1 - 0scarclassc 1.0.1 - 0scarclassd 1.0.1 - 0scarclasse 1.0...

0beny1s (1.1.6), 0desgin (0.0.1) +15142 more potentially affected by CVE-2026-53666 via react-router (>=6.4.0, <=7.17.0)

react-router NPM version =6.4.0, =7.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on react-router and may be impacted: - 0beny1s 1.1.6 - 0desgin 0.0.1 - 0scarclassa 1.0.1 - 0scarclassb 1.0.1 - 0scarclassc 1.0.1 - 0scarclassd 1.0.1 - 0scarclasse 1.0...

PT-2026-64215

Name of the Vulnerable Software and Affected Versions React Router versions 6.0.0 through 7.17.0 Description An open redirect issue exists where the use of backslashes in the component and the useNavigate function can lead to unexpected external navigations when attacker-supplied paths are...

PT-2026-64213

Name of the Vulnerable Software and Affected Versions React Router versions 7.11.0 through 7.17.0 Description The RSCErrorHandler lacks protocol validation, which allows redirects from untrusted sources. This can lead to a Cross-Site Scripting XSS vector—a technique where malicious scripts are...

react-router: React Router: Cross-Site Scripting vulnerability via untrusted React Server Component redirects

A flaw was found in React Router. This vulnerability, a type of Cross-Site Scripting XSS, affects applications utilizing React Router's unstable React Server Components RSC APIs. A remote attacker could exploit this by sending untrusted redirects, leading to the execution of malicious scripts in...

react-router: React Router: Denial of Service via client-side Cross-Site Scripting in RSC redirect handling

A flaw was found in React Router versions 7.7.0 through 7.13.1. When using the unstable React Server Components RSC APIs, insufficient sanitization of redirect targets allows client-side cross-site scripting if redirects originate from untrusted sources. An attacker could inject script that...

react-router: React Router: Remote Code Execution via prototype pollution in Framework Mode

A flaw was found in React Router when operating in Framework Mode. A remote attacker could exploit an existing prototype pollution vulnerability within the application code. This could lead to unauthorized remote code execution RCE on the server through a two-step attack involving external...

react-router: @remix-run/server-runtime: React Router / Remix: Denial of Service via unbounded path expansion in __manifest endpoint

A flaw was found in React Router and @remix-run/server-runtime. A remote attacker can exploit this vulnerability by sending certain crafted requests to the manifest endpoint. This can lead to unbounded path expansion, consuming disproportionate server resources. The primary consequence is a denia...

CVE-2026-42211

A flaw was found in React Router when operating in Framework Mode. A remote attacker could exploit an existing prototype pollution vulnerability within the application code. This could lead to unauthorized remote code execution RCE on the server through a two-step attack involving external...

Security Bulletin: Multiple Vulnerabilities in React Router bundled with IBM Fusion, IBM Fusion HCI and IBM Fusion Data Cataloging

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging include the react-router library, which is affected by multiple vulnerabilities, including cross-site scripting XSS, cross-site request forgery CSRF, and open redirect vulnerabilities. CVE-2026-21884, CVE-2026-22029, CVE-2026-2203...

Security Bulletin: IBM Security QRadar Log Management AQL Plugin is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. IBM Security QRadar Log Management AQL Plugin has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-34077 DESCRIPTION: React...

Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Genius Hub

Summary The following dependency packages are being used by IBM Db2 Genius Hub - urllib3, tornado, tensorflow, requests, pythondotenv, pytest, Pygments, idna, flask, certifi, react-router, brace-expansion, golang.org/x/sys, golang.org/x/net, golang.org/x/crypto, axios, RedisBloom, redis,...

Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty

Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Transformation Advisor. Vulnerability Details CVEID:CVE-2026-40181 DESCRIPTION: React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3,...

SUSE CVE-2025-61686

React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage is being used from @react-router/node or @remix-run/node/@remix-run/deno in Remix v2 with an...

org.webjars.npm:browser-sync-ui (2.27.11), org.webjars.npm:comunica__core (1.8.0) +12 more potentially affected by CVE-2026-59879 via org.webjars.npm:immutable (4.0.0-rc.12)

org.webjars.npm:immutable MAVEN version 4.0.0-rc.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:immutable and may be impacted: - org.webjars.npm:browser-sync-ui 2.27.11 - org.webjars.npm:comunicacore 1.8.0 -...

org.webjars.npm:browser-sync-ui (2.27.11), org.webjars.npm:comunica__core (1.8.0) +12 more potentially affected by CVE-2026-59880 via org.webjars.npm:immutable (4.0.0-rc.12)

org.webjars.npm:immutable MAVEN version 4.0.0-rc.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:immutable and may be impacted: - org.webjars.npm:browser-sync-ui 2.27.11 - org.webjars.npm:comunicacore 1.8.0 -...

Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Summary Multiple vulnerabilities were addressed in IBM API Connect version v10.0.8.10 Vulnerability Details CVEID:CVE-2026-33244 DESCRIPTION: React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the...

ROOT-APP-NPM-CVE-2026-22030 CVE-2026-22030 in @rootio/react-router - Patched by Root

Root has patched CVE-2026-22030 in the @rootio/react-router package for Root:npm. Multiple fixed versions available...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in React Router

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in React Router. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-33244 DESCRIPTION: React Router is a router for React. In versions 7.5.1 through 7.13.1, when using...