Skip to content
Fencer Vulns
high 8.2

CVE-2026-21884 json

React Router SSR XSS in ScrollRestoration

published 2026-01-08 10 mo ago modified 2026-09-08 2 mo ago also GHSA-8v8x-cx79-35w7 , EUVD-2026-1466

cvss
8.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits
0
none known

Summary

React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. There is no impact if server-side rendering in Framework Mode is disabled, or if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/react version 2.17.3 and react-router version 7.12.0.

Patch / fix

  • npm react-router 7.12.0
  • npm @remix-run/react 2.17.3
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:2.6.6-1.el9ap
  • Red Hat Red Hat Ansible Automation Platform 2.6 1772543959
  • Red Hat Red Hat OpenShift AI 2.25 1772093424, 1772093498
  • Red Hat Red Hat OpenShift AI 3.3 1778473763, 1778666987, 1779189627
  • receptor ansible automation platform 2.6 1.6.3-4.el10ap
  • receptor ansible automation platform inside 2.6, ansible automation platform developer 2.6, ansible automation platform 2.6 1.6.3-4.el9ap
  • receptorctl ansible automation platform 2.6 1.6.3-4.el10ap
  • receptorctl ansible automation platform inside 2.6, ansible automation platform developer 2.6, ansible automation platform 2.6 1.6.3-4.el9ap
  • python3.12-django ansible automation platform developer 2.6, ansible automation platform 2.6 4.2.28-1.el9ap
  • python3.12-aiohttp ansible automation platform 2.6 3.13.3-2.el9ap
  • python3.12-protobuf ansible automation platform 2.6 5.29.6-1.el9ap
  • automation-controller ansible automation platform developer 2.6, ansible automation platform 2.6 4.7.9-1.el9ap

red hat advisories RHSA-2026:3958

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-21884 updated cvss 8.2

react-router: @remix-run/react: React Router SSR XSS in ScrollRestoration

  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26 1772543959
    fixed: vendor fix RHSA-2026:3960
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-platform-ui 2.6.6-1.el9ap
    fixed: vendor fix RHSA-2026:3958
  • Red Hat OpenShift AI 2.25 rhoai 1772093424, rhoai 1772093498
    fixed: vendor fix RHSA-2026:3782
  • Red Hat OpenShift AI 3.3 rhoai 1778473763, rhoai 1778666987, rhoai 1779189627
    fixed: vendor fix RHSA-2026:19712
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform 1772556678, ansible-automation-platform 1772556679, ansible-automation-platform-26 1772204398, ansible-automation-platform-26 1772381996, ansible-automation-platform-26 1772382003, ansible-automation-platform-26 1772382254, +21 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 tox 4.15.1-2.el9ap, uwsgi 2.0.28-2.el9ap, bindep 2.13.0-2.el9ap, receptor 1.6.3-4.el9ap, yamllint 1.35.1-2.el9ap, molecule 25.12.0-2.el9ap, +332 more Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor 1.6.3-4.el10ap, receptorctl 1.6.3-4.el10ap, ansible-core 2.16.16-2.el10ap, python-django 4.2.28-2.el10ap, python3-django 4.2.28-2.el10ap
    not affected: vulnerable code not present
  • Red Hat Build of Kueue kueue/kueue-rhel9, kueue/kueue-rhel9-operator, kueue/kueue-operator-bundle, kueue/kueue-must-gather-rhel9
    not affected: component not present
  • Red Hat Enterprise Linux 9 ipa, ipa-client, ipa-common, ipa-server, ipa-selinux, ipa-client-epn, +13 more Red Hat Enterprise Linux 10 ipa Red Hat OpenShift AI 2.25 rhoai 1772093237, rhoai 1772093250, rhoai 1772093252, rhoai 1772093260, rhoai 1772093266, rhoai 1772093272, +62 more Red Hat OpenShift AI 3.3 rhoai 1778239104, rhoai 1778262829, rhoai 1778262856, rhoai 1778262893, rhoai 1778262907, rhoai 1778262952, +73 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
9 mo ago

Exploit prediction

0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
CISA ADP 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
GitHub 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm react-router
>=7.0.0, <7.12.0
7.12.0
npm @remix-run/react
<2.17.3
2.17.3

Affected products

  • remix-run react-router
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.6
  • Red Hat Red Hat OpenShift AI 2.25
  • Red Hat Red Hat OpenShift AI 3.3
  • Red Hat Red Hat Build of Kueue
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 9

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.