{"schemaVersion":3,"id":"CVE-2026-22029","aliases":["GHSA-2w69-qvjg-hvjx","openSUSE-SU-2026:10069-1"],"status":"published","duplicateOf":null,"title":null,"description":"React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<BrowserRouter>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.","dates":{"published":"2026-01-10T02:42:32.736Z","modified":"2026-09-10T12:04:57.289Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","exploitability":4.1,"impact":9.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00866,"percentile":0.58039,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":-0.01299999999999999,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00879},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00866,"percentile":0.58039}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00879,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00866,"percentile":0.58039}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"Npm","product":"react-router","name":"react-router","label":"react-router","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/react-router","purlType":"npm","versions":[{"text":"≥ 7.0.0, < 7.12.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 7.0.0, < 7.12.0","eol":null,"hubHref":null},{"vendor":"@remix-run","product":"router","name":"@remix-run/router","label":"router","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/@remix-run/router","purlType":"npm","versions":[{"text":"< 1.23.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.23.2","eol":null,"hubHref":null},{"vendor":"remix-run","product":"react-router","name":"react-router","label":"react-router","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 7.0.0, < 7.12.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 7.0.0, < 7.12.0","eol":null,"hubHref":"/vendor/remix-run/react-router"},{"vendor":"remix-run","product":"@remix-run/router","name":"@remix-run/router","label":"@remix-run/router","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.23.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.23.2","eol":null,"hubHref":"/vendor/remix-run/remix-runrouter"},{"vendor":"opensuse","product":"heroic-games-launcher&distro=openSUSE Tumbleweed","name":"heroic-games-launcher","label":"heroic-games-launcher&distro=openSUSE Tumbleweed","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/heroic-games-launcher&distro=openSUSE Tumbleweed","purlType":"rpm","versions":[{"text":"< 2.18.1-2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.18.1-2.1","eol":null,"hubHref":null},{"vendor":"shopify","product":"react-router","name":"react-router","label":"react-router","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 7.0.0, ≤ 7.11.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 7.0.0, ≤ 7.11.0","eol":null,"hubHref":"/vendor/shopify/react-router"},{"vendor":"shopify","product":"remix-run\\/react","name":"remix-run\\/react","label":"remix-run\\/react","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.23.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.23.2","eol":null,"hubHref":"/vendor/shopify/remix-runreact"}],"affectedCount":7,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/remix-run/react-router/security/advisories/GHSA-2w69-qvjg-hvjx","label":"github.com/remix-run/react-router/security/advisories/GHSA-2w69-qvjg-hvjx","hostname":"github.com","tags":["X Refsource CONFIRM","WEB","Vendor Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-22029","label":"access.redhat.com/security/cve/CVE-2026-22029","hostname":"access.redhat.com","tags":["VDB Entry","X Refsource REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2428412","label":"bugzilla.redhat.com/show_bug.cgi?id=2428412","hostname":"bugzilla.redhat.com","tags":["Issue Tracking","X Refsource REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22029.json","label":"security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22029.json","hostname":"security.access.redhat.com","tags":["X Sadp Csaf Vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3959","label":"access.redhat.com/errata/RHSA-2026:3959","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3958","label":"access.redhat.com/errata/RHSA-2026:3958","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41064","label":"access.redhat.com/errata/RHSA-2026:41064","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:5633","label":"access.redhat.com/errata/RHSA-2026:5633","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8229","label":"access.redhat.com/errata/RHSA-2026:8229","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36882","label":"access.redhat.com/errata/RHSA-2026:36882","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2572","label":"access.redhat.com/errata/RHSA-2026:2572","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13548","label":"access.redhat.com/errata/RHSA-2026:13548","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:1517","label":"access.redhat.com/errata/RHSA-2026:1517","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2350","label":"access.redhat.com/errata/RHSA-2026:2350","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2568","label":"access.redhat.com/errata/RHSA-2026:2568","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3960","label":"access.redhat.com/errata/RHSA-2026:3960","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2694","label":"access.redhat.com/errata/RHSA-2026:2694","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36651","label":"access.redhat.com/errata/RHSA-2026:36651","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40945","label":"access.redhat.com/errata/RHSA-2026:40945","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40118","label":"access.redhat.com/errata/RHSA-2026:40118","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41928","label":"access.redhat.com/errata/RHSA-2026:41928","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3782","label":"access.redhat.com/errata/RHSA-2026:3782","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19712","label":"access.redhat.com/errata/RHSA-2026:19712","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34100","label":"access.redhat.com/errata/RHSA-2026:34100","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21658","label":"access.redhat.com/errata/RHSA-2026:21658","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20042","label":"access.redhat.com/errata/RHSA-2026:20042","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20041","label":"access.redhat.com/errata/RHSA-2026:20041","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17469","label":"access.redhat.com/errata/RHSA-2026:17469","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17468","label":"access.redhat.com/errata/RHSA-2026:17468","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17474","label":"access.redhat.com/errata/RHSA-2026:17474","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2456","label":"access.redhat.com/errata/RHSA-2026:2456","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2147","label":"access.redhat.com/errata/RHSA-2026:2147","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2148","label":"access.redhat.com/errata/RHSA-2026:2148","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2149","label":"access.redhat.com/errata/RHSA-2026:2149","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26420","label":"access.redhat.com/errata/RHSA-2026:26420","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26413","label":"access.redhat.com/errata/RHSA-2026:26413","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40984","label":"access.redhat.com/errata/RHSA-2026:40984","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:3087","label":"access.redhat.com/errata/RHSA-2026:3087","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13542","label":"access.redhat.com/errata/RHSA-2026:13542","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9848","label":"access.redhat.com/errata/RHSA-2026:9848","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:5636","label":"access.redhat.com/errata/RHSA-2026:5636","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8218","label":"access.redhat.com/errata/RHSA-2026:8218","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22029","label":"nvd.nist.gov/vuln/detail/CVE-2026-22029","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/remix-run/react-router","label":"github.com/remix-run/react-router","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22029","label":"www.suse.com/security/cve/CVE-2026-22029","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":["RHSA-2026:3958","RHSA-2026:3959"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-01-10T02:42:32.736Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-10T12:04:57.289Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":32,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T07:42:40.142Z","stale":false,"partial":false}}