[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-42211":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T11:35:27.363Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":24,"aliases":25,"duplicate_of":9,"upstream":33,"downstream":34,"duplicates":37,"related":38,"reserved_at":9,"published_at":41,"modified_at":42,"state":43,"summary":44,"references_raw":53,"kevs":79,"epss":80,"epss_history":83,"metrics":356,"affected":370},"CVE-2026-42211","React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (`\u003CBrowserRouter>`) or Data Mode (`createBrowserRouter/\u003CRouterProvider>`). This is patched in version 7.14.2.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-502","Deserialization of Untrusted Data","The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.","weakness","Draft","Base","Medium",[20],{"id":21,"name":22,"techniques":23},"CAPEC-586","Object Injection",[],[],[26,27,28,29,30,31,32],"GHSA-49rj-9fvp-4h2h","CGA-fj7j-p542-xv5w","CGA-266p-f7c6-9c9g","CGA-2cr4-rx7v-2pj6","CGA-6frx-g9v6-jvv2","CGA-cq5j-275m-qh6g","CGA-r8xm-p2pr-p53g",[],[35],{"_key":36},"RHSA-2026:29770",[],[39],{"_key":40},"CGA-CVXH-V32M-4C25","2026-06-02T18:18:46.706Z","2026-06-03T14:08:30.154Z","Analyzed",{"cisa_kev":45,"cisa_ransomware":45,"cisa_vendor":9,"epss_severity":46,"epss_score":47,"severity":48,"severity_score":49,"severity_version":50,"severity_source":51,"severity_vector":52,"severity_status":43},false,"low",0.00416,"high",8.1,"v3.1","cve.org","CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",[54,66,70,75],{"url":55,"sources":56,"tags":61},"https://github.com/remix-run/react-router/security/advisories/GHSA-49rj-9fvp-4h2h",[51,57,58,59,60],"nvd","osv_npm","osv_wolfi","osv_chainguard",[62,63,64,65],"X Refsource CONFIRM","WEB","Vendor Advisory","Advisory",{"url":67,"sources":68,"tags":69},"https://nvd.nist.gov/vuln/detail/CVE-2026-42211",[58,59,60],[65],{"url":71,"sources":72,"tags":73},"https://github.com/remix-run/react-router",[58],[74],"PACKAGE",{"url":76,"sources":77,"tags":78},"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42211.json",[59,60],[65],[],{"date":81,"score":47,"percentile":82},"2026-09-19",0.35552,[84,88,91,95,98,101,105,108,111,114,117,120,123,127,130,133,136,139,142,145,148,151,154,157,160,163,166,168,171,174,177,180,183,186,189,192,194,197,200,203,206,209,212,215,218,221,224,227,230,233,236,239,242,245,248,251,254,257,260,263,266,269,272,275,278,281,284,287,290,293,296,299,302,305,308,311,314,317,320,323,326,329,332,335,338,341,344,347,350,353],{"date":85,"score":86,"percentile":87},"2026-06-03",0.00252,0.48723,{"date":89,"score":86,"percentile":90},"2026-06-04",0.48742,{"date":92,"score":93,"percentile":94},"2026-06-05",0.00253,0.48875,{"date":96,"score":93,"percentile":97},"2026-06-06",0.48883,{"date":99,"score":93,"percentile":100},"2026-06-07",0.48865,{"date":102,"score":103,"percentile":104},"2026-06-08",0.00333,0.56421,{"date":106,"score":103,"percentile":107},"2026-06-09",0.56438,{"date":109,"score":103,"percentile":110},"2026-06-10",0.56488,{"date":112,"score":103,"percentile":113},"2026-06-11",0.56513,{"date":115,"score":103,"percentile":116},"2026-06-12",0.56632,{"date":118,"score":103,"percentile":119},"2026-06-13",0.56647,{"date":121,"score":103,"percentile":122},"2026-06-14",0.56635,{"date":124,"score":125,"percentile":126},"2026-06-15",0.00374,0.28977,{"date":128,"score":125,"percentile":129},"2026-06-16",0.2902,{"date":131,"score":125,"percentile":132},"2026-06-17",0.29043,{"date":134,"score":125,"percentile":135},"2026-06-18",0.29081,{"date":137,"score":125,"percentile":138},"2026-06-19",0.29069,{"date":140,"score":125,"percentile":141},"2026-06-20",0.29048,{"date":143,"score":125,"percentile":144},"2026-06-21",0.29031,{"date":146,"score":125,"percentile":147},"2026-06-22",0.29015,{"date":149,"score":47,"percentile":150},"2026-06-23",0.33143,{"date":152,"score":47,"percentile":153},"2026-06-24",0.33178,{"date":155,"score":47,"percentile":156},"2026-06-25",0.33253,{"date":158,"score":47,"percentile":159},"2026-06-26",0.33296,{"date":161,"score":47,"percentile":162},"2026-06-27",0.33341,{"date":164,"score":47,"percentile":165},"2026-06-28",0.33316,{"date":167,"score":47,"percentile":165},"2026-06-29",{"date":169,"score":47,"percentile":170},"2026-06-30",0.33287,{"date":172,"score":47,"percentile":173},"2026-07-01",0.33393,{"date":175,"score":47,"percentile":176},"2026-07-02",0.33423,{"date":178,"score":47,"percentile":179},"2026-07-03",0.33438,{"date":181,"score":47,"percentile":182},"2026-07-04",0.33443,{"date":184,"score":47,"percentile":185},"2026-07-05",0.33458,{"date":187,"score":47,"percentile":188},"2026-07-06",0.33463,{"date":190,"score":47,"percentile":191},"2026-07-07",0.33465,{"date":193,"score":47,"percentile":191},"2026-07-08",{"date":195,"score":47,"percentile":196},"2026-07-09",0.33512,{"date":198,"score":47,"percentile":199},"2026-07-10",0.33533,{"date":201,"score":47,"percentile":202},"2026-07-11",0.33566,{"date":204,"score":47,"percentile":205},"2026-07-12",0.33558,{"date":207,"score":47,"percentile":208},"2026-07-13",0.33577,{"date":210,"score":47,"percentile":211},"2026-07-14",0.33594,{"date":213,"score":47,"percentile":214},"2026-07-15",0.33672,{"date":216,"score":47,"percentile":217},"2026-07-16",0.33708,{"date":219,"score":47,"percentile":220},"2026-07-17",0.33713,{"date":222,"score":47,"percentile":223},"2026-07-18",0.33724,{"date":225,"score":47,"percentile":226},"2026-07-19",0.33721,{"date":228,"score":47,"percentile":229},"2026-07-20",0.33798,{"date":231,"score":47,"percentile":232},"2026-07-21",0.33807,{"date":234,"score":47,"percentile":235},"2026-07-22",0.33987,{"date":237,"score":47,"percentile":238},"2026-07-23",0.33991,{"date":240,"score":47,"percentile":241},"2026-07-24",0.3401,{"date":243,"score":47,"percentile":244},"2026-07-25",0.34088,{"date":246,"score":47,"percentile":247},"2026-07-26",0.34083,{"date":249,"score":47,"percentile":250},"2026-07-27",0.34058,{"date":252,"score":47,"percentile":253},"2026-07-28",0.34116,{"date":255,"score":47,"percentile":256},"2026-07-29",0.34131,{"date":258,"score":47,"percentile":259},"2026-07-30",0.34201,{"date":261,"score":47,"percentile":262},"2026-07-31",0.34226,{"date":264,"score":47,"percentile":265},"2026-08-01",0.3423,{"date":267,"score":47,"percentile":268},"2026-08-02",0.34232,{"date":270,"score":47,"percentile":271},"2026-08-03",0.34244,{"date":273,"score":47,"percentile":274},"2026-08-04",0.34221,{"date":276,"score":47,"percentile":277},"2026-08-05",0.34193,{"date":279,"score":47,"percentile":280},"2026-08-06",0.34223,{"date":282,"score":47,"percentile":283},"2026-08-07",0.34262,{"date":285,"score":47,"percentile":286},"2026-08-08",0.3427,{"date":288,"score":47,"percentile":289},"2026-08-09",0.34252,{"date":291,"score":47,"percentile":292},"2026-08-10",0.34265,{"date":294,"score":47,"percentile":295},"2026-08-11",0.3436,{"date":297,"score":47,"percentile":298},"2026-08-12",0.34444,{"date":300,"score":47,"percentile":301},"2026-08-13",0.34482,{"date":303,"score":47,"percentile":304},"2026-08-14",0.34537,{"date":306,"score":47,"percentile":307},"2026-08-15",0.34666,{"date":309,"score":47,"percentile":310},"2026-08-16",0.34696,{"date":312,"score":47,"percentile":313},"2026-08-17",0.34638,{"date":315,"score":47,"percentile":316},"2026-08-18",0.3466,{"date":318,"score":47,"percentile":319},"2026-08-19",0.34844,{"date":321,"score":47,"percentile":322},"2026-08-20",0.34908,{"date":324,"score":47,"percentile":325},"2026-08-21",0.34941,{"date":327,"score":47,"percentile":328},"2026-08-22",0.3495,{"date":330,"score":47,"percentile":331},"2026-08-23",0.34865,{"date":333,"score":47,"percentile":334},"2026-08-24",0.34351,{"date":336,"score":47,"percentile":337},"2026-08-25",0.34377,{"date":339,"score":47,"percentile":340},"2026-08-26",0.34467,{"date":342,"score":47,"percentile":343},"2026-08-27",0.34495,{"date":345,"score":47,"percentile":346},"2026-08-28",0.34456,{"date":348,"score":47,"percentile":349},"2026-08-29",0.3449,{"date":351,"score":47,"percentile":352},"2026-08-30",0.34589,{"date":354,"score":47,"percentile":355},"2026-08-31",0.34605,[357,362,364,366,368],{"source":51,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":358,"cvss_v4_0":9},{"baseScore":49,"baseSeverity":359,"vectorString":52,"impactScore":360,"exploitabilityScore":361},"HIGH",9.8,5.6,{"source":57,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":363,"cvss_v4_0":9},{"baseScore":49,"baseSeverity":359,"vectorString":52,"impactScore":360,"exploitabilityScore":361},{"source":58,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":365,"cvss_v4_0":9},{"baseScore":49,"baseSeverity":9,"vectorString":52,"impactScore":360,"exploitabilityScore":361},{"source":59,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":367,"cvss_v4_0":9},{"baseScore":49,"baseSeverity":9,"vectorString":52,"impactScore":360,"exploitabilityScore":361},{"source":60,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":369,"cvss_v4_0":9},{"baseScore":49,"baseSeverity":9,"vectorString":52,"impactScore":360,"exploitabilityScore":361},[371,381,385,392,397,408,414],{"ecosystem":372,"name":373,"vendor":374,"product":373,"cpe_part":9,"purl_type":375,"purl_namespace":374,"purl_name":373,"source":9,"versions":376},"Chainguard","airflow-2","chainguard","apk",[377],{"version":378,"is_range":379,"range_type":380,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",true,"ecosystem",{"ecosystem":372,"name":382,"vendor":374,"product":382,"cpe_part":9,"purl_type":375,"purl_namespace":374,"purl_name":382,"source":9,"versions":383},"airflow-core-2",[384],{"version":378,"is_range":379,"range_type":380,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":372,"name":386,"vendor":374,"product":386,"cpe_part":9,"purl_type":375,"purl_namespace":374,"purl_name":386,"source":9,"versions":387},"vitess-24",[388],{"version":389,"is_range":379,"range_type":380,"version_start":9,"version_start_type":9,"version_end":390,"version_end_type":391,"fixed_in":9},"lt24_0_1_r2","24.0.1-r2","excluding",{"ecosystem":393,"name":386,"vendor":394,"product":386,"cpe_part":9,"purl_type":375,"purl_namespace":394,"purl_name":386,"source":9,"versions":395},"Wolfi","wolfi",[396],{"version":389,"is_range":379,"range_type":380,"version_start":9,"version_start_type":9,"version_end":390,"version_end_type":391,"fixed_in":9},{"ecosystem":398,"name":399,"vendor":398,"product":399,"cpe_part":9,"purl_type":400,"purl_namespace":9,"purl_name":399,"source":9,"versions":401},"Npm","react-router","npm",[402],{"version":403,"is_range":379,"range_type":404,"version_start":405,"version_start_type":406,"version_end":407,"version_end_type":391,"fixed_in":9},"gte7_0_0_lt7_14_2","semver","7.0.0","including","7.14.2",{"ecosystem":9,"name":399,"vendor":409,"product":399,"cpe_part":410,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":411},"remix-run","a",[412],{"version":413,"is_range":379,"range_type":51,"version_start":405,"version_start_type":406,"version_end":407,"version_end_type":391,"fixed_in":9},">= 7.0.0, \u003C 7.14.2",{"ecosystem":9,"name":399,"vendor":415,"product":399,"cpe_part":410,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":416},"shopify",[417],{"version":418,"is_range":379,"range_type":419,"version_start":405,"version_start_type":406,"version_end":407,"version_end_type":391,"fixed_in":9},"gte7.0.0_lt7.14.2","cpe"]