Cross-site Request Forgery (CSRF)

🗓️ 08 Jan 2026 20:57:09Reported by Snyk Security DatabaseType

CSRF in UI route actions via Framework Mode from origin checks; upgrade react-router to 7.12.0.

Reporter	Title	Published	Views	Family All 25
IBM Security Bulletins	Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	6 Apr 202617:16	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: react-router-7.11.0.tgz (CVE-2026-21884, CVE-2026-22029, CVE-2026-22030)	11 May 202618:23	–	ibm
IBM Security Bulletins	Security Bulletin: Carbon Charts React Router Security Vulnerabilities	27 Apr 202607:14	–	ibm
IBM Security Bulletins	Security Bulletin: XSS Vulnerability in React Router meta()/Meta APIs During SSR, affects watsonx.data	10 Apr 202605:59	–	ibm
Circl	CVE-2026-22030	10 Jan 202604:02	–	circl
CNNVD	react-router 跨站请求伪造漏洞	10 Jan 202600:00	–	cnnvd
CVE	CVE-2026-22030	10 Jan 202602:42	–	cve
Cvelist	CVE-2026-22030 React Router has CSRF issue in Action/Server Action Request Processing	10 Jan 202602:42	–	cvelist
EUVD	EUVD-2026-1464	10 Jan 202602:42	–	euvd
Github Security Blog	React Router has CSRF issue in Action/Server Action Request Processing	8 Jan 202620:57	–	github

Vulners

Node

shopify react-routerRange7.0.0–7.12.0

Source	Link
cwe	www.cwe.mitre.org/data/definitions/CWE-346.html
security	www.security.snyk.io/vuln/SNYK-JS-REACTROUTER-14908429
cwe	www.cwe.mitre.org/data/definitions/CWE-352.html

13 Jan 2026 14:33Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.16.5

CVSS 46.9

EPSS0.00128

SSVC