Skip to content
Fencer Vulns
high 8.0

CVE-2026-22029 json

React Router vulnerable to XSS via Open Redirects

published 2026-01-08 10 mo ago modified 2026-09-10 1 mo ago also EUVD-2026-1465 , GHSA-2w69-qvjg-hvjx

cvss
8.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 58%
public exploits
0
none known

Summary

React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<BrowserRouter>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.

Patch / fix

  • npm react-router 7.12.0
  • npm @remix-run/router 1.23.2
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:2.5.20260225-1.el8ap
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:2.5.20260225-1.el9ap
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:2.6.6-1.el9ap
  • Red Hat multicluster engine for Kubernetes 2.1 1777128790
  • Red Hat multicluster engine for Kubernetes 2.6 1776223790
  • Red Hat multicluster engine for Kubernetes 2.7 1773100128
  • Red Hat multicluster engine for Kubernetes 2.8 1775116156
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 1783350952
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.12 1773259174
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13 1775116130
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14 1769990632, 1782693386
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15 1776927126
  • Red Hat Red Hat Advanced Cluster Security 4.8 1769615659
  • Red Hat Red Hat Advanced Cluster Security 4.9 1770074713, 1770250889
  • Red Hat Red Hat Ansible Automation Platform 2.6 1772543959
  • Red Hat Red Hat Discovery 2 1770913709
  • Red Hat Red Hat Edge Manager 1.0 1783502438, 1783502765
  • Red Hat Red Hat Edge Manager 1.1 1784126822, 1784127736, 1784194574, 1784194938
  • Red Hat Red Hat Migration Toolkit 1.8 1783690532
  • Red Hat Red Hat OpenShift AI 2.25 1772093424, 1772093498
  • Red Hat Red Hat OpenShift AI 3.3 1778473763, 1778666987, 1779189627
  • Red Hat Red Hat OpenShift Container Platform 4.17 1782269794
  • Red Hat Red Hat OpenShift Container Platform 4.18 1779874967
  • Red Hat Red Hat OpenShift Container Platform 4.19 1779249920, 1779256322
  • Red Hat Red Hat OpenShift Container Platform 4.20 1778645008, 1778645099
  • Red Hat Red Hat OpenShift Container Platform 4.21 1778539338
  • Red Hat Red Hat Openshift Data Foundation 4.18 1781554936, 1781555645, 1781555679, 1781555708, 1781555717, 1781555971, 1781556009, 1781556085, 1781556534, 1781556544, 1781556690, 1781556901, 1781556958, 1781557158, 1781557189, 1781557202, 1781557496, 1781558326, 1781558423
  • Red Hat Red Hat Openshift Data Foundation 4.19 1781550255, 1781550415, 1781550551, 1781550593, 1781550615, 1781550670, 1781550759, 1781550761, 1781550777, 1781550908, 1781550957, 1781551060, 1781551098, 1781551130, 1781551169, 1781551235, 1781551276, 1781551472, 1781551499, 1781554417
  • receptor ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.3-4.el8ap
  • receptor ansible automation platform inside 2.6, ansible automation platform inside 2.5, ansible automation platform developer 2.6 +3 more 1.6.3-4.el9ap
  • receptorctl ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.3-4.el8ap
  • receptorctl ansible automation platform inside 2.6, ansible automation platform inside 2.5, ansible automation platform developer 2.6 +3 more 1.6.3-4.el9ap
  • python3.12-django ansible automation platform developer 2.5, ansible automation platform 2.5 4.2.28-1.el8ap
  • python3.12-django ansible automation platform developer 2.6, ansible automation platform developer 2.5, ansible automation platform 2.6 +1 more 4.2.28-1.el9ap
  • automation-gateway ansible automation platform 2.5 2.5.20260225-1.el8ap
  • automation-gateway ansible automation platform 2.5 2.5.20260225-1.el9ap

red hat advisories RHSA-2026:3959RHSA-2026:3958

  • heroic-games-launcher openSUSE Tumbleweed 2.18.1-2.1

opensuse advisories openSUSE-SU-2026:10069-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-22029 updated cvss 8.0

@remix-run/router: react-router: React Router vulnerable to XSS via Open Redirects

  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8, openshift-logging/logging-loki-rhel9, openshift-logging/loki-rhel9-operator, openshift-logging/opa-openshift-rhel9, openshift-logging/elasticsearch6-rhel9, openshift-logging/loki-operator-bundle, +6 more Red Hat Migration Toolkit for Virtualization mtv-candidate/mtv-console-plugin-rhel9, migration-toolkit-virtualization/mtv-console-plugin-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Multicluster Engine for Kubernetes multicluster-engine/console-mce-rhel8 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-api-rhel8, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9, openshift-pipelines/pipelines-hub-db-migration-rhel8
    affected: workaround, no fix available
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/prometheus-rhel9, rhacm2/acm-flightctl-ui-rhel9, rhacm2/acm-flightctl-ocp-ui-rhel9, rhacm2/prometheus-alertmanager-rhel9 Red Hat Ansible Automation Platform 2 automation-hub, python3.11-galaxy-ng, ansible-on-clouds/aoc-azure-aap-installer-rhel9, ansible-automation-platform-25/aap-cloud-ui-rhel8
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat build of Apicurio Registry 2 io.apicurio-apicurio-registry
    affected: workaround, no fix available
  • Red Hat Connectivity Link 1 rhcl-1/rhcl-console-plugin-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Data Grid 8 org.infinispan-infinispan-console Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9 Red Hat Edge Manager preview rhem/flightctl-ui-rhel9, rhem/flightctl-api-rhel9, rhem/flightctl-ui-ocp-rhel9, rhem/flightctl-worker-rhel9, rhacm2/acm-flightctl-ui-rhel9, rhem/flightctl-db-setup-rhel9, +7 more
    affected: workaround, no fix available
  • Red Hat Fuse 7 io.syndesis-syndesis-parent
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-dashboard-rhel8
    affected: workaround, no fix available
show 25 more
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-console-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift distributed tracing 3 rhosdt/tempo-jaeger-query-rhel8
    affected: workaround, no fix available
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9, openshift-gitops-1/console-plugin-rhel8, openshift-gitops-1/gitops-operator-bundle
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9
    affected: workaround, no fix available
  • Red Hat Process Automation 7 org.uberfire-uberfire-parent
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Quay 3 quay/quay-rhel8, quay/quay-rhel9
    affected: workaround, no fix available
  • Red Hat Single Sign-On 7 org.keycloak-keycloak-parent
    affected: workaround, no fix planned “Will not fix”
  • Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine 1776223790
    fixed: vendor fix RHSA-2026:9848
  • Red Hat multicluster engine for Kubernetes 2.7 multicluster-engine 1773100128
    fixed: vendor fix RHSA-2026:5636
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine 1775116156
    fixed: vendor fix RHSA-2026:8218
  • Red Hat multicluster engine for Kubernetes 2.10 multicluster-engine 1777128790
    fixed: vendor fix RHSA-2026:13542
  • Red Hat Advanced Cluster Management for Kubernetes 2.11 rhacm2/console-rhel9 1783350952
    fixed: vendor fix RHSA-2026:41064
  • Red Hat Advanced Cluster Management for Kubernetes 2.12 rhacm2 1773259174
    fixed: vendor fix RHSA-2026:5633
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2 1775116130
    fixed: vendor fix RHSA-2026:8229
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2 1769990632, rhacm2/acm-grafana-rhel9 1782693386
    fixed: vendor fix RHSA-2026:36882
  • Red Hat Advanced Cluster Management for Kubernetes 2.15 rhacm2 1776927126
    fixed: vendor fix RHSA-2026:13548
  • Red Hat Advanced Cluster Security 4.8 advanced-cluster-security 1769615659
    fixed: vendor fix RHSA-2026:1517
  • Red Hat Advanced Cluster Security 4.9 advanced-cluster-security 1770074713, advanced-cluster-security 1770250889
    fixed: vendor fix RHSA-2026:2350
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-gateway 2.5.20260225-1.el8ap, automation-gateway-config 2.5.20260225-1.el8ap, automation-gateway-server 2.5.20260225-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-gateway 2.5.20260225-1.el9ap, automation-gateway-config 2.5.20260225-1.el9ap, automation-gateway-server 2.5.20260225-1.el9ap
    fixed: vendor fix RHSA-2026:3959
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26 1772543959
    fixed: vendor fix RHSA-2026:3960
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-platform-ui 2.6.6-1.el9ap
    fixed: vendor fix RHSA-2026:3958
  • Red Hat Discovery 2 discovery 1770913709
    fixed: vendor fix RHSA-2026:2694
  • Red Hat Edge Manager 1.0 rhem/flightctl-ui-rhel9 1783502438, rhem/flightctl-ui-ocp-rhel9 1783502765
    fixed: vendor fix RHSA-2026:36651
  • Red Hat Edge Manager 1.1 rhem/flightctl-ui-rhel9 1784127736, rhem/flightctl-ui-rhel10 1784194574, rhem/flightctl-ui-ocp-rhel9 1784126822, rhem/flightctl-ui-ocp-rhel10 1784194938
    fixed: vendor fix RHSA-2026:40945
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 1783690532
    fixed: vendor fix RHSA-2026:41928

16 more fixed, 57 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
9 mo ago

Exploit prediction

0.87% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
CISA ADP 3.1 8.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
GitHub 3.1 8.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm react-router
>=7.0.0, <7.12.0
7.12.0
npm @remix-run/router
<1.23.2
1.23.2

Affected products

  • remix-run react-router
  • remix-run @remix-run/router
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat multicluster engine for Kubernetes 2.1
  • Red Hat multicluster engine for Kubernetes 2.6
  • Red Hat multicluster engine for Kubernetes 2.7
  • Red Hat multicluster engine for Kubernetes 2.8
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.12
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Red Hat Advanced Cluster Security 4.8
  • Red Hat Red Hat Advanced Cluster Security 4.9
  • Red Hat Red Hat Ansible Automation Platform 2.6
  • Red Hat Red Hat Discovery 2
  • Red Hat Red Hat Edge Manager 1.0
  • Red Hat Red Hat Edge Manager 1.1
  • Red Hat Red Hat Migration Toolkit 1.8
  • Red Hat Red Hat OpenShift AI 2.25
  • Red Hat Red Hat OpenShift AI 3.3
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat OpenShift Container Platform 4.18
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat OpenShift Container Platform 4.20
  • Red Hat Red Hat OpenShift Container Platform 4.21
  • Red Hat Red Hat Openshift Data Foundation 4.18
  • Red Hat Red Hat Openshift Data Foundation 4.19
  • Red Hat Red Hat Openshift Data Foundation 4.20
  • Red Hat Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • Red Hat Red Hat OpenShift Service Mesh 3.0
  • Red Hat Red Hat OpenShift Service Mesh 3.1
  • Red Hat Red Hat OpenShift Service Mesh 3.2
  • Red Hat Red Hat Trusted Artifact Signer 1.3
  • Red Hat Cryostat 4
  • Red Hat Gatekeeper 3
  • Red Hat Logging Subsystem for Red Hat OpenShift
  • Red Hat Migration Toolkit for Applications 7
  • Red Hat Migration Toolkit for Applications 8
  • Red Hat Migration Toolkit for Virtualization
  • Red Hat Multicluster Engine for Kubernetes
  • Red Hat Network Observability Operator
  • Red Hat Node HealthCheck Operator
  • Red Hat OpenShift Lightspeed
  • Red Hat OpenShift Pipelines
  • Red Hat OpenShift Service Mesh 2
  • Red Hat OpenShift Service Mesh 3
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.