128981semzub (1.0.1), @1023-ventures/merope2 (>=0.2.1, <=0.2.9) +2268 more potentially affected by CVE-2025-68470 via react-router (>=6.0.0, <=6.30.1)

react-router NPM version =6.0.0, =0.2.1, =0.5.0, =0.0.1, =0.0.1, =3.0.0, =4.0.61, =4.0.61, =4.0.61, =4.0.61, =4.0.61, =0.0.0-beta-20260120211922, =1.0.0, =1.0.0, =2.12.12 and more Source cves: CVE-2025-68470 Source advisory: OSV:GHSA-9JCX-V3WJ-WH4M...

31g-form-parser (1.0.107), @accounter/client (>=0.0.3-alpha-20241124130832-1498e8a00d2fa532e452b5ad126a753f4844a237, <=0.0.8-alpha-20251116113354-eb9acd1bac5b0d5268422adf712fa45e3bcc44f2) +228 more potentially affected by CVE-2025-68470 via react-router (>=7.0.0, <=7.9.5-pre.0)

react-router NPM version =7.0.0, =0.0.3-alpha-20241124130832-1498e8a00d2fa532e452b5ad126a753f4844a237, =0.0.2, =3.4.0, =0.2.3, =1.1.0, =1.0.3, =0.1.0, =3.3.7, =3.0.0-alpha.2, =3.0.0-alpha.10, =3.4.1 and more Source cves: CVE-2025-68470 Source advisory: OSV:GHSA-9JCX-V3WJ-WH4M...

GHSA-9JCX-V3WJ-WH4M React Router has unexpected external redirect via untrusted paths

An attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate, , or redirect, the app performs a navigation/redirect to an external URL. This is only an issue if developers pass untrusted content into navigation paths in their application code...

@buttery/studio (>=0.2.3, <=0.3.7), @c0va23/react-router-dev (>=7.8.3-alpha.1, <=7.8.3-alpha.2) +18 more potentially affected by CVE-2025-61686 via @react-router/node (>=7.0.0, <=7.9.3-pre.0)

@react-router/node NPM version =7.0.0, =0.2.3, =7.8.3-alpha.1, =0.1.0, =0.0.1-dev.8, =0.0.1-0, =0.0.1-alpha.6, =3.8.8, =7.0.0-pre.0, =7.0.0-pre.0, =7.0.0-pre.0, =0.0.1-alpha.23, =0.0.1, =0.1.0-xyd.22, =0.1.0-xyd.20, =0.1.0-xyd.29 and more Source cves: CVE-2025-61686 Source advisory:...

@buttery/studio (>=0.2.3, <=0.3.7), @c0va23/react-router-dev (>=7.8.3-alpha.1, <=7.8.3-alpha.2) +18 more potentially affected by CVE-2025-61686 via @react-router/node (>=7.0.0, <=7.9.3-pre.0)

@react-router/node NPM version =7.0.0, =0.2.3, =7.8.3-alpha.1, =0.1.0, =0.0.1-dev.8, =0.0.1-0, =0.0.1-alpha.6, =3.8.8, =7.0.0-pre.0, =7.0.0-pre.0, =7.0.0-pre.0, =0.0.1-alpha.23, =0.0.1, =0.1.0-xyd.22, =0.1.0-xyd.20, =0.1.0-xyd.29 and more Source cves: CVE-2025-61686 Source advisory:...

GHSA-9583-H5HC-X8CW React Router has Path Traversal in File Session Storage

If applications use createFileSessionStorage from @react-router/node or @remix-run/node/@remix-run/deno in Remix v2 with an unsigned cookie, it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the...

31g-form-parser (1.0.107), @accounter/client (>=0.0.3-alpha-20241124130832-1498e8a00d2fa532e452b5ad126a753f4844a237, <=0.0.7-alpha-20250916121934-9a6d7df081f77b13548a6a7e5478a1361f5c91e8) +209 more potentially affected by CVE-2025-59057 via react-router (>=7.0.0, <=7.8.2-pre.1)

react-router NPM version =7.0.0, =0.0.3-alpha-20241124130832-1498e8a00d2fa532e452b5ad126a753f4844a237, =0.0.2, =3.4.0, =0.2.3, =1.1.0, =0.1.0, =3.0.0-alpha.2, =3.0.0-alpha.10, =15.0.12, =0.0.1-ssmch, =0.6.9-alpha-7 and more Source cves: CVE-2025-59057 Source advisory: OSV:GHSA-3CGP-3XVW-98X8...

@b42inc/remix-i18n (0.0.1), @briandlee/remix-return-navigation (>=1.0.0-post, <=1.1.0-dev0) +69 more potentially affected by CVE-2025-59057 via @remix-run/react (>=1.15.0, <=2.17.0-pre.1)

@remix-run/react NPM version =1.15.0, =1.0.0-post, =0.1.2, =1.0.0, =6.0.6-alpha.23, =0.0.2-alpha.0, =0.0.1, =0.0.1, =0.1.0, =1.0.0, =0.0.22, =0.0.6, =0.0.1, =5.6.0, =5.28.0 and more Source cves: CVE-2025-59057 Source advisory: OSV:GHSA-3CGP-3XVW-98X8...

31g-form-parser (1.0.107), @accounter/client (>=0.0.3-alpha-20241124130832-1498e8a00d2fa532e452b5ad126a753f4844a237, <=0.0.7-alpha-20250916121934-9a6d7df081f77b13548a6a7e5478a1361f5c91e8) +209 more potentially affected by CVE-2025-59057 via react-router (>=7.0.0, <=7.8.2-pre.1)

react-router NPM version =7.0.0, =0.0.3-alpha-20241124130832-1498e8a00d2fa532e452b5ad126a753f4844a237, =0.0.2, =3.4.0, =0.2.3, =1.1.0, =0.1.0, =3.0.0-alpha.2, =3.0.0-alpha.10, =15.0.12, =0.0.1-ssmch, =0.6.9-alpha-7 and more Source cves: CVE-2025-59057 Source advisory: SNYK:JS-REACTROUTER-14908289...

@b42inc/remix-i18n (0.0.1), @briandlee/remix-return-navigation (>=1.0.0-post, <=1.1.0-dev0) +69 more potentially affected by CVE-2025-59057 via @remix-run/react (>=1.15.0, <=2.17.0-pre.1)

@remix-run/react NPM version =1.15.0, =1.0.0-post, =0.1.2, =1.0.0, =6.0.6-alpha.23, =0.0.2-alpha.0, =0.0.1, =0.0.1, =0.1.0, =1.0.0, =0.0.22, =0.0.6, =0.0.1, =5.6.0, =5.28.0 and more Source cves: CVE-2025-59057 Source advisory: SNYK:JS-REMIXRUNREACT-14908290...

React Router has XSS Vulnerability

A XSS vulnerability exists in in React Router's meta/ APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. !NOTE This does not impact applications using Declarative Mode or Data Mod...

Cross-site Scripting (XSS)

Overview @remix-run/react is a React DOM bindings for Remix Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Meta API in Framework Mode when generating script:ld+json tags during server-side rendering with untrusted content. An attacker can execute arbitrary...

GHSA-3CGP-3XVW-98X8 React Router has XSS Vulnerability

A XSS vulnerability exists in in React Router's meta/ APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. !NOTE This does not impact applications using Declarative Mode or Data Mod...

Exploit for Deserialization of Untrusted Data in Facebook React

No d...

Exploit for Deserialization of Untrusted Data in Facebook React

🛠️ React2Shell - Simplifying React Exploitation Framework...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 React2Shell - Proof of Concept ⚠️ SECURIT...

PT-2026-1810

🟠 React Router, Cross-Site Request Forgery, CVE-2025-47216 Moderate https://t.co/LQdTXi1ca7...

PT-2026-1914

Name of the Vulnerable Software and Affected Versions React Router versions 6.0.0 through 6.30.1 React Router versions 7.0.0 through 7.9.5 Description An attacker-supplied path can be crafted to force a React Router application to perform a navigation or redirect to an external URL. This occurs...

PT-2026-2137

Name of the Vulnerable Software and Affected Versions React Router versions 7.0.0 through 7.11.0 @remix-run/router versions prior to 1.23.2 Description React Router, a router for React, is susceptible to open redirect issues. Specifically, Single Page Applications SPAs using React Router and Remi...

PT-2026-2120

Name of the Vulnerable Software and Affected Versions @remix-run/react versions prior to 2.17.3 react-router versions 7.0.0 through 7.11.0 Description React Router, a router for React, contains a cross-site scripting XSS issue within the API when operating in Framework Mode during Server-Side...