Description
React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. There is no impact if server-side rendering in Framework Mode is disabled, or if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/react version 2.17.3 and react-router version 7.12.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| remix-run | react-router | @remix-run/react < 2.17.3, react-router >= 7.0.0, < 7.12.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ansible Automation Platform Inside 2 | receptor +1 | 1.6.3-4.el9ap | RHSA-2026:3958 |
| Red Hat Ansible Automation Platform Developer 2 | automation-controller +1 | 4.7.9-1.el9ap | RHSA-2026:3958 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-django | 4.2.28-1.el9ap | RHSA-2026:3958 |
| Red Hat Ansible Automation Platform Developer 2 | receptor +1 | 1.6.3-4.el9ap | RHSA-2026:3958 |
| Red Hat Ansible Automation Platform 2 | automation-controller +4 | 4.7.9-1.el9ap | RHSA-2026:3958 |
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | 2.6.6-1.el9ap | RHSA-2026:3958 |
| Red Hat Ansible Automation Platform 2 | python3.12-aiohttp | 3.13.3-2.el9ap | RHSA-2026:3958 |
| Red Hat Ansible Automation Platform 2 | python3.12-django | 4.2.28-1.el9ap | RHSA-2026:3958 |
| Red Hat Ansible Automation Platform 2 | python3.12-protobuf | 5.29.6-1.el9ap | RHSA-2026:3958 |
| Red Hat Ansible Automation Platform 2 | receptor +1 | 1.6.3-4.el9ap | RHSA-2026:3958 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @remix-run/react | < 2.17.3 | 2.17.3 | GHSA-8v8x-cx79-35w7 |
| npm | react-router | >= 7.0.0, < 7.12.0 | 7.12.0 | GHSA-8v8x-cx79-35w7 |
Advisories 2
- RHSA-2026:3958 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2026-0752 IBM SPSS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 7, 2026