{"id":"CVE-2026-21884","aliases":["CLSA-2026-1788960805","CLSA-2026-1792161542","CLSA-2026-1792253405","CLSA-2026-1792279963","CLSA-2026-1792279967","CLSA-2026-1792419115","CLSA-2026-1792419193","CLSA-2026-1792419272","CLSA-2026-1792419630","CLSA-2026-1792421947","CLSA-2026-1792424735","CLSA-2026-1792425411","CLSA-2026-1792428110","CLSA-2026-1792430035","EUVD-2026-1466","GHSA-8v8x-cx79-35w7","RHSA-2026:3958","ROOT-APP-NPM-CVE-2026-21884"],"status":"published","title":"React Router SSR XSS in ScrollRestoration","description":"React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's \u003cScrollRestoration\u003e API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. There is no impact if server-side rendering in Framework Mode is disabled, or if Declarative Mode (\u003cBrowserRouter\u003e) or Data Mode (createBrowserRouter/\u003cRouterProvider\u003e) is being used. This issue has been patched in @remix-run/react version 2.17.3 and react-router version 7.12.0.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00531,"percentile":0.45206,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-01-08T20:50:05Z","modified":"2026-11-10T19:58:30Z","fixes":[{"ecosystem":"npm","package":"react-router","fixed_in":["7.12.0"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@remix-run/react","fixed_in":["2.17.3"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"react-router-dom","fixed_in":["7.5.1-tuxcare.10"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@remix-run/react","fixed_in":["1.19.3-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@react-router/architect","fixed_in":["7.5.1-tuxcare.10"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@react-router/express","fixed_in":["7.5.1-tuxcare.10"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@react-router/node","fixed_in":["7.5.1-tuxcare.10"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@react-router/remix-routes-option-adapter","fixed_in":["7.5.1-tuxcare.10"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@react-router/dev","fixed_in":["7.5.1-tuxcare.10"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@react-router/serve","fixed_in":["7.5.1-tuxcare.10"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"react-router","fixed_in":["7.12.0-aikido.1","7.12.0-aikido.2","7.12.0-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/react-router","fixed_in":["7.12.0-root.io.1","7.12.0-root.io.2","7.12.0-root.io.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.12.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@remix-run/react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.3"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.10"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.2","7.5.1-tuxcare.3","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6","7.5.1-tuxcare.7","7.5.1-tuxcare.8","7.5.1-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.10"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.2","7.5.1-tuxcare.3","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6","7.5.1-tuxcare.7","7.5.1-tuxcare.8","7.5.1-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@remix-run/server-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.3-tuxcare.0"},{"fixed":"1.19.3-tuxcare.4"}]}],"versions":["1.19.3","1.19.3-tuxcare.1","1.19.3-tuxcare.2","1.19.3-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.10"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6","7.5.1-tuxcare.7","7.5.1-tuxcare.8","7.5.1-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@remix-run/react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.0-tuxcare.0"},{"fixed":"2.17.0-tuxcare.1"}]}],"versions":["2.17.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@remix-run/react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.3-tuxcare.0"},{"fixed":"1.19.3-tuxcare.4"}]}],"versions":["1.19.3","1.19.3-tuxcare.1","1.19.3-tuxcare.2","1.19.3-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/architect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.10"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6","7.5.1-tuxcare.7","7.5.1-tuxcare.8","7.5.1-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/cloudflare","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.10"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6","7.5.1-tuxcare.7","7.5.1-tuxcare.8","7.5.1-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.10"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6","7.5.1-tuxcare.7","7.5.1-tuxcare.8","7.5.1-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.10"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6","7.5.1-tuxcare.7","7.5.1-tuxcare.8","7.5.1-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/remix-routes-option-adapter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.10"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6","7.5.1-tuxcare.7","7.5.1-tuxcare.8","7.5.1-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.10"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6","7.5.1-tuxcare.7","7.5.1-tuxcare.8","7.5.1-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/fs-routes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.10"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6","7.5.1-tuxcare.7","7.5.1-tuxcare.8","7.5.1-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@react-router/serve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.10"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6","7.5.1-tuxcare.7","7.5.1-tuxcare.8","7.5.1-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.1-tuxcare.0"},{"fixed":"7.5.1-tuxcare.10"}]}],"versions":["7.5.1","7.5.1-tuxcare.1","7.5.1-tuxcare.4","7.5.1-tuxcare.5","7.5.1-tuxcare.6","7.5.1-tuxcare.7","7.5.1-tuxcare.8","7.5.1-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"react-router","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.12.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@remix-run/react","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.17.3"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-platform-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.6-1.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"python3.12-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.28-1.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.28-1.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-4.el10ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-4.el10ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-4.el10ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-4.el10ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-4.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-4.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-4.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-4.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-4.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-4.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-4.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-4.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.3-2.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.3-2.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.3-2.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-protobuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.29.6-1.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-protobuf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.29.6-1.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-protobuf-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.29.6-1.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.9-1.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.9-1.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.9-1.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.9-1.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.9-1.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.9-1.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.9-1.el9ap"}]}],"bundled":14},{"source":"osv","ecosystem":"Root:npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.12.0-aikido.1"},{"fixed":"7.12.0-aikido.2"},{"fixed":"7.12.0-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.12.0-root.io.1"},{"fixed":"7.12.0-root.io.2"},{"fixed":"7.12.0-root.io.3"}]}]}],"products":[{"vendor":"@tanstack","product":"react-router"},{"vendor":"red hat","product":"red hat ansible automation platform 2.6"},{"vendor":"red hat","product":"red hat ansible automation platform 2.6 for rhel 9"},{"vendor":"red hat","product":"red hat build of kueue"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift ai 2.25"},{"vendor":"red hat","product":"red hat openshift ai 3.3"},{"vendor":"remix-run","product":"react-router"},{"vendor":"shopify","product":"react-router"},{"vendor":"shopify","product":"remix-run\\/react"}],"references":[{"url":"https://github.com/remix-run/react-router/security/advisories/GHSA-8v8x-cx79-35w7","tags":["x_refsource_CONFIRM","Third Party Advisory","advisory","web","article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-21884","tags":["vdb-entry","x_refsource_REDHAT","advisory","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2428421","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21884.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3958","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3960","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3782","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19712","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21884","tags":["advisory"]},{"url":"https://github.com/remix-run/react-router/pull/14705","tags":["web"]},{"url":"https://github.com/remix-run/react-router/commit/c89c32c562a7723c45ee71dab1c892acaf7a608d","tags":["web"]},{"url":"https://github.com/remix-run/react-router/blob/react-router%407.12.0/CHANGELOG.md#v7120","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8v8x-cx79-35w7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21884.json","tags":["advisory"]},{"url":"https://github.com/remix-run/react-router","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/html/release_notes/patch_releases","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2427456","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2428412","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2428426","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430472","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431740","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431959","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2432398","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2434432","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436338","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436339","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436340","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436341","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436342","tags":["report"]},{"url":"https://issues.redhat.com/browse/AAP-62864","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3958.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-13465","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-13465","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13465","tags":["advisory"]},{"url":"https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-14550","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14550","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14550","tags":["advisory"]},{"url":"https://docs.djangoproject.com/en/dev/releases/security/","tags":["article"]},{"url":"https://groups.google.com/g/django-announce","tags":["article"]},{"url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-59057","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59057","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59057","tags":["advisory"]},{"url":"https://github.com/remix-run/react-router/security/advisories/GHSA-3cgp-3xvw-98x8","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61726","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61726","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61726","tags":["advisory"]},{"url":"https://go.dev/cl/736712","tags":["article"]},{"url":"https://go.dev/issue/77101","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4341","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69223","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69223","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69223","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgg","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-0994","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0994","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0994","tags":["advisory"]},{"url":"https://github.com/protocolbuffers/protobuf/pull/25239","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1207","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1207","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1207","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1285","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1285","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1285","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1287","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1287","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1287","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1312","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1312","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1312","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-21884","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-22029","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-22029","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22029","tags":["advisory"]},{"url":"https://github.com/remix-run/react-router/security/advisories/GHSA-2w69-qvjg-hvjx","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-23490","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-23490","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23490","tags":["advisory"]},{"url":"https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970","tags":["article"]},{"url":"https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2","tags":["article"]},{"url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-24049","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-24049","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24049","tags":["advisory"]},{"url":"https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef","tags":["article"]},{"url":"https://github.com/pypa/wheel/releases/tag/0.46.2","tags":["article"]},{"url":"https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2026-21884","title":"React Router SSR XSS in ScrollRestoration","description":"React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's \u003cScrollRestoration\u003e API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. There is no impact if server-side rendering in Framework Mode is disabled, or if Declarative Mode (\u003cBrowserRouter\u003e) or Data Mode (createBrowserRouter/\u003cRouterProvider\u003e) is being used. This issue has been patched in @remix-run/react version 2.17.3 and react-router version 7.12.0.","status":"published","published":"2026-01-10T02:41:44.944Z","modified":"2026-07-15T01:19:46.847Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-79","CWE-79"],"updated_at":"2026-11-02T13:41:42.05254Z"}],"euvd":[{"id":"EUVD-2026-1466","description":"React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's \u003cScrollRestoration\u003e API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. There is no impact if server-side rendering in Framework Mode is disabled, or if Declarative Mode (\u003cBrowserRouter\u003e) or Data Mode (createBrowserRouter/\u003cRouterProvider\u003e) is being used. This issue has been patched in @remix-run/react version 2.17.3 and react-router version 7.12.0.","status":"published","published":"2026-01-10T02:41:44Z","modified":"2026-07-15T01:19:46Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T18:19:55.318488Z"}],"ghsa":[{"id":"GHSA-8v8x-cx79-35w7","title":"React Router SSR XSS in ScrollRestoration","description":"A XSS vulnerability exists in in React Router's `\u003cScrollRestoration\u003e` API in [Framework Mode](https://reactrouter.com/start/modes#framework) when using the `getKey`/`storageKey` props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys.\n\n\u003e [!NOTE]\n\u003e This does not impact applications if developers have [disabled server-side rendering](https://reactrouter.com/how-to/spa) in Framework Mode, or if they are using [Declarative Mode](https://reactrouter.com/start/modes#declarative) (`\u003cBrowserRouter\u003e`) or [Data Mode](https://reactrouter.com/start/modes#data) (`createBrowserRouter`/`\u003cRouterProvider\u003e`).","status":"published","published":"2026-01-08T20:50:05Z","modified":"2026-09-08T16:29:56Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:41:13.477974Z"}],"nvd":[{"id":"CVE-2026-21884","description":"React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's \u003cScrollRestoration\u003e API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. There is no impact if server-side rendering in Framework Mode is disabled, or if Declarative Mode (\u003cBrowserRouter\u003e) or Data Mode (createBrowserRouter/\u003cRouterProvider\u003e) is being used. This issue has been patched in @remix-run/react version 2.17.3 and react-router version 7.12.0.","status":"published","published":"2026-01-10T03:15:48.673Z","modified":"2026-07-15T02:18:31.757Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:03.683495Z"}],"osv":[{"id":"CVE-2026-21884","title":"React Router SSR XSS in ScrollRestoration","description":"React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's \u003cScrollRestoration\u003e API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. There is no impact if server-side rendering in Framework Mode is disabled, or if Declarative Mode (\u003cBrowserRouter\u003e) or Data Mode (createBrowserRouter/\u003cRouterProvider\u003e) is being used. This issue has been patched in @remix-run/react version 2.17.3 and react-router version 7.12.0.","status":"published","published":"2026-01-10T02:41:44.944Z","modified":"2026-10-28T02:31:13.930024514Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:58.42038Z"},{"id":"GHSA-8v8x-cx79-35w7","title":"React Router SSR XSS in ScrollRestoration","description":"A XSS vulnerability exists in in React Router's `\u003cScrollRestoration\u003e` API in [Framework Mode](https://reactrouter.com/start/modes#framework) when using the `getKey`/`storageKey` props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys.\n\n\u003e [!NOTE]\n\u003e This does not impact applications if developers have [disabled server-side rendering](https://reactrouter.com/how-to/spa) in Framework Mode, or if they are using [Declarative Mode](https://reactrouter.com/start/modes#declarative) (`\u003cBrowserRouter\u003e`) or [Data Mode](https://reactrouter.com/start/modes#data) (`createBrowserRouter`/`\u003cRouterProvider\u003e`).","status":"published","published":"2026-01-08T20:50:05Z","modified":"2026-09-08T16:45:04.19013316Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:42.78452Z"},{"id":"RHSA-2026:3958","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update","status":"published","published":"2026-03-07T10:11:38Z","modified":"2026-10-20T10:08:41Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"CLSA-2026-1788960805","title":"TuxCare security update for 2 packages (3 CVEs)","description":"TuxCare rebuilt 2 packages to address 3 CVEs. Fixed in 7.5.1-tuxcare.10.","status":"published","published":"2026-09-09T13:33:25Z","modified":"2026-10-19T19:15:10.875246428Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1792161542","title":"TuxCare security update for @remix-run/server-runtime (1 CVE)","description":"TuxCare rebuilt @remix-run/server-runtime to address 1 CVE. Fixed in 1.19.3-tuxcare.4.","status":"published","published":"2026-10-16T14:39:02Z","modified":"2026-11-10T19:45:16.404779982Z","updated_at":"2026-11-10T20:12:40.351566Z"},{"id":"CLSA-2026-1792253405","title":"TuxCare security update for react-router-dom (1 CVE)","description":"TuxCare rebuilt react-router-dom to address 1 CVE. Fixed in 7.5.1-tuxcare.10.","status":"published","published":"2026-10-17T16:10:02Z","modified":"2026-11-02T19:59:10.566196669Z","updated_at":"2026-11-02T20:20:38.202286Z"},{"id":"CLSA-2026-1792279963","title":"TuxCare security update for @remix-run/react (2 CVEs)","description":"TuxCare rebuilt @remix-run/react to address 2 CVEs. Fixed in 2.17.0-tuxcare.1.","status":"published","published":"2026-10-17T23:32:43Z","modified":"2026-11-10T19:58:30.614944044Z","updated_at":"2026-11-10T20:07:15.512362Z"},{"id":"CLSA-2026-1792279967","title":"TuxCare security update for @remix-run/react (1 CVE)","description":"TuxCare rebuilt @remix-run/react to address 1 CVE. Fixed in 1.19.3-tuxcare.4.","status":"published","published":"2026-10-17T23:32:46Z","modified":"2026-11-10T19:58:23.079242683Z","updated_at":"2026-11-10T20:07:25.465481Z"},{"id":"CLSA-2026-1792419115","title":"TuxCare security update for @react-router/architect (1 CVE)","description":"TuxCare rebuilt @react-router/architect to address 1 CVE. Fixed in 7.5.1-tuxcare.10.","status":"published","published":"2026-10-19T14:11:51Z","modified":"2026-11-10T19:58:18.384856718Z","updated_at":"2026-11-10T20:07:30.871041Z"},{"id":"CLSA-2026-1792419193","title":"TuxCare security update for @react-router/cloudflare (1 CVE)","description":"TuxCare rebuilt @react-router/cloudflare to address 1 CVE. Fixed in 7.5.1-tuxcare.10.","status":"published","published":"2026-10-19T14:13:09Z","modified":"2026-11-10T19:46:01.731620122Z","updated_at":"2026-11-10T20:12:20.089751Z"},{"id":"CLSA-2026-1792419272","title":"TuxCare security update for @react-router/express (1 CVE)","description":"TuxCare rebuilt @react-router/express to address 1 CVE. Fixed in 7.5.1-tuxcare.10.","status":"published","published":"2026-10-19T14:14:28Z","modified":"2026-11-02T19:59:07.86218343Z","updated_at":"2026-11-02T20:20:54.36149Z"},{"id":"CLSA-2026-1792419630","title":"TuxCare security update for @react-router/node (1 CVE)","description":"TuxCare rebuilt @react-router/node to address 1 CVE. Fixed in 7.5.1-tuxcare.10.","status":"published","published":"2026-10-19T14:20:28Z","modified":"2026-11-02T19:58:26.962464374Z","updated_at":"2026-11-02T20:24:01.862566Z"},{"id":"CLSA-2026-1792421947","title":"TuxCare security update for @react-router/remix-routes-option-adapter (1 CVE)","description":"TuxCare rebuilt @react-router/remix-routes-option-adapter to address 1 CVE. Fixed in 7.5.1-tuxcare.10.","status":"published","published":"2026-10-19T14:59:05Z","modified":"2026-11-10T19:58:22.793269976Z","updated_at":"2026-11-10T20:07:25.465481Z"},{"id":"CLSA-2026-1792424735","title":"TuxCare security update for @react-router/dev (1 CVE)","description":"TuxCare rebuilt @react-router/dev to address 1 CVE. Fixed in 7.5.1-tuxcare.10.","status":"published","published":"2026-10-19T15:45:31Z","modified":"2026-11-02T19:58:42.320973447Z","updated_at":"2026-11-02T20:22:53.438589Z"},{"id":"CLSA-2026-1792425411","title":"TuxCare security update for @react-router/fs-routes (1 CVE)","description":"TuxCare rebuilt @react-router/fs-routes to address 1 CVE. Fixed in 7.5.1-tuxcare.10.","status":"published","published":"2026-10-19T15:56:47Z","modified":"2026-11-10T19:45:56.721687171Z","updated_at":"2026-11-10T20:12:31.252427Z"},{"id":"CLSA-2026-1792428110","title":"TuxCare security update for @react-router/serve (1 CVE)","description":"TuxCare rebuilt @react-router/serve to address 1 CVE. Fixed in 7.5.1-tuxcare.10.","status":"published","published":"2026-10-19T16:41:47Z","modified":"2026-11-02T19:58:35.871972025Z","updated_at":"2026-11-02T20:23:21.540308Z"},{"id":"CLSA-2026-1792430035","title":"TuxCare security update for create-react-router (1 CVE)","description":"TuxCare rebuilt create-react-router to address 1 CVE. Fixed in 7.5.1-tuxcare.10.","status":"published","published":"2026-10-19T17:13:52Z","modified":"2026-11-10T19:45:56.891637671Z","updated_at":"2026-11-10T20:12:31.252427Z"},{"id":"ROOT-APP-NPM-CVE-2026-21884","title":"CVE-2026-21884 in react-router - Patched by Root","description":"Root has patched CVE-2026-21884 in the react-router package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-04T12:12:16Z","modified":"2026-08-04T19:30:20.970734557Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}