XSS Vulnerability in React Router: Open Redirects Risk
Summary
GHSA-2w69-qvjg-hvjx: React Router vulnerable to XSS via Open Redirects. Affects react-router versions >= 7.0.0, < 7.12.0. Fixed in 7.12.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
React Router is a popular library for managing navigation in single-page applications (SPAs) built with React. It allows developers to create dynamic routing and manage the application's state based on the URL. The library supports various modes of operation, including Framework Mode and Data Mode, which can introduce vulnerabilities if not handled correctly. This specific vulnerability arises from the potential for open redirects, which can lead to cross-site scripting (XSS) attacks if developers use untrusted content for redirect paths.
Vulnerability Detail
The vulnerability in React Router and Remix versions 7.0.0 to 7.11.0 stems from open navigation redirects that can occur when using loaders or actions in Framework Mode, Data Mode, or unstable RSC modes. If developers create redirect paths from untrusted sources, it can lead to unsafe URLs that execute unintended JavaScript on the client side. This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) and has a CVSS score of 8.0, indicating a high severity level.
How To Fix
Latest published version: 8.5.0 as of 23 Oct 2026
npm install react-router@8.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.12.0
This is the first release that contains the fix.
npm install react-router@7.12.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, ensure that any redirect paths are strictly validated and sanitized to prevent untrusted content from being used. Implement checks to ensure that redirects only lead to safe, predefined URLs.
Conclusion
The identified XSS vulnerability in React Router due to open redirects poses a significant risk to applications using affected versions. Developers are urged to update to the latest patched versions and implement strict validation for redirect paths to mitigate potential attacks. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for react-router →
FAQ
An open redirect is a vulnerability that allows an attacker to redirect users to an untrusted site, potentially leading to phishing attacks or malware distribution.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By checking your package-lock.json file, Vulert can help you identify if your application is affected by this vulnerability.
Exploiting this vulnerability can lead to XSS attacks, where attackers can execute malicious scripts in the context of the user's browser, potentially stealing sensitive information or hijacking user sessions.
No, this vulnerability affects React Router versions 7.0.0 to 7.11.0. Versions 7.12.0 and later have addressed this issue.
Vulert is a tool that monitors open-source vulnerabilities in your software using just the package-lock.json file. It provides real-time alerts for vulnerabilities, helping you maintain the security of your applications.
References
Related vulnerabilities
Recent vulnerabilities recorded for react-router.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
