REDHAT-BUG-2428421: XSS
React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. There is no impact if server-side rendering in Framework Mode is disabled, or if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/react version 2.17.3 and react-router version 7.12.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@remix-run/reactto a version that resolves this vulnerability.Fixed in 2.17.3 - Upgrade
Upgrade
react-routerto a version that resolves this vulnerability.Fixed in 7.12.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2428421?
The severity of REDHAT-BUG-2428421 is classified as high, with a score of 7.
How do I fix REDHAT-BUG-2428421?
To fix REDHAT-BUG-2428421, update @remix-run/react to version 2.17.3 or later and react-router to version 7.11.1 or later.
What type of vulnerability is found in REDHAT-BUG-2428421?
REDHAT-BUG-2428421 contains an XSS (Cross-Site Scripting) vulnerability.
Which components are affected by REDHAT-BUG-2428421?
The affected components in REDHAT-BUG-2428421 are @remix-run/react versions prior to 2.17.3 and react-router versions 7.0.0 through 7.11.0.
What does the Red Hat bug report REDHAT-BUG-2428421 describe?
The Red Hat bug report REDHAT-BUG-2428421 describes an XSS vulnerability in the <ScrollRestoration> API of React Router when certain props are used during Server-Side Rendering.