React Router and Remix Open Redirect Vulnerability Leading to Cross-Site Scripting

A cross-site scripting vulnerability has been identified in React Router and Remix versions that allow single-page application (SPA) open navigation redirects. This issue is present in @remix-run/router versions prior to 1.23.2 and in react-router versions 7.0.0 through 7.11.0. The vulnerability arises from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes, where unsafe URLs can be created from untrusted content or via an open redirect, leading to unintended JavaScript execution on the client side. However, this issue does not affect applications using Declarative Mode with <BrowserRouter>.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can upgrade to @remix-run/router version 1.23.2 or react-router version 7.12.0 to address this vulnerability.