Arbitrary Code Injection

Overview @aws-amplify/codegen-ui-react is an Amplify UI React code generation implementation Affected versions of this package are vulnerable to Arbitrary Code Injection through the ReactThemeStudioTemplateRenderer in packages/codegen-ui-react/lib/react-theme-studio-template-renderer.ts. An...

CVE-2026-18245

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...

CVE-2026-18245 Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...

CVE-2026-18245 Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...

react-router: React Router: Open Redirect vulnerability via backslashes in navigation components

A flaw was found in React Router, a routing library for React applications. A remote attacker could exploit this vulnerability by crafting a malicious link that uses backslashes within the or useNavigate components. This could lead to an Open Redirect, allowing the attacker to redirect users to...

react-router: React Router: Open Redirect vulnerability via backslashes in navigation components

A flaw was found in React Router, a routing library for React applications. A remote attacker could exploit this vulnerability by crafting a malicious link that uses backslashes within the or useNavigate components. This could lead to an Open Redirect, allowing the attacker to redirect users to...

Malicious code in react-fast-refresh-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcca3ccc0a35a13d8b3f30ff6019ab57782882ada4e01b941fbee77ad1236115 Package typosquats a React/Meta-branded name and falsely attributes authorship to 'Meta Open Source'. Its package.json declares a postinstall hook...

MAL-2026-11366 Malicious code in react-fast-refresh-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcca3ccc0a35a13d8b3f30ff6019ab57782882ada4e01b941fbee77ad1236115 Package typosquats a React/Meta-branded name and falsely attributes authorship to 'Meta Open Source'. Its package.json declares a postinstall hook...

CVE-2026-18245: Improper Control of Generation of Code

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...

CVE-2026-55685

A flaw was found in React Router. An unauthenticated attacker can send targeted requests to the manifest endpoint, leading to a denial of service DoS. This can put a heavy load on the server, significantly slowing down response times and impacting the availability of the application. Mitigation...

MAL-2026-11144 Malicious code in react-puller (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3ac07c0f6c79714a7b1f6bfd1272f9f7942cf0473875ca5276a1034c084f06d The package's postinstall hook runs node index.js, which spawns a detached worker that downloads two Windows executables CDPUserPlatform.exe and...

CVE-2026-53667

A flaw was found in React Router. The RSCErrorHandler component, used in applications leveraging unstable React Server Components RSC Application Programming Interfaces APIs, is missing crucial protocol validation. This vulnerability allows an attacker to redirect users to untrusted external...

CVE-2026-53668

A flaw was found in React Router. Applications using React Router that allow open redirects are vulnerable to Cross-Site Scripting XSS. A remote attacker could craft a malicious link that, when clicked by a user, redirects them to an unexpected external site or exploits an XSS vulnerability,...

CVE-2026-53666

A flaw was found in React Router. If an application is configured to allow attacker-supplied input to modify errors during server-side rendering SSR, a remote attacker could trigger unexpected code execution on the client. This execution could lead to an outbound network request, potentially...

CVE-2026-53669

A flaw was found in React Router, a routing library for React applications. A remote attacker could exploit this vulnerability by crafting a malicious link that uses backslashes within the or useNavigate components. This could lead to an Open Redirect, allowing the attacker to redirect users to...

Linux Distros Unpatched Vulnerability : CVE-2026-53666

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite...

Linux Distros Unpatched Vulnerability : CVE-2026-53669

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in and useNavigate. This issue is ...

DoS (Denial of Service) react-router Dependency in Jira Service Management Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.3.8, 10.7.1, 11.0.0, and 11.1.0 of Jira Service Management Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

DoS (Denial of Service) react-router Dependency in Jira Software Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.3.8, 10.7.1, 11.0.0, and 11.1.0 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:...

CVE-2026-55685

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React...