CVE-2026-21884: remix-run react-router Cross-site Scripting

Vulnerability summary

CVE-2026-21884 is a high (CVSS 8.2) Cross-site Scripting vulnerability in remix-run react-router. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 43.6% of scored vulnerabilities.

Timeline

1. 10-01-2026
   PublishedVulnerability first disclosed.
2. 15-07-2026
   Last modifiedVulnerability information updated.

Description

React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. There is no impact if server-side rendering in Framework Mode is disabled, or if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/react version 2.17.3 and react-router version 7.12.0.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.