PT-2026-46085 · Npm · React Router

Publicado 2026-06-03 · Atualizado 2026-06-03

OSV

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

When using React Router v7 in Framework Mode, there exists a combination of steps that could potentially allow unauthorized RCE through external requests. This first requires the application code to have an existing prototype pollution vulnerability. This can be leveraged into a 2-step attack in which the second step can trigger unauthorized RCE on the remote server.

[!NOTE] This does not impact your React Router application if you are using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

GHSA-49RJ-9FVP-4H2H

Produtos afetados

React Router

Referências · 4

• https://github.com/remix-run/react-router/security/advisories/GHSA-49rj-9fvp-4h2h · Nota
• https://github.com/remix-run/react-router · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-42211 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-49rj-9fvp-4h2h · Aviso do Fabricante