React Router Prototype Pollution Vulnerability Leading to Remote Code Execution

A vulnerability in React Router versions 7.0.0 through 7.14.1, when used in Framework Mode, could allow unauthorized remote code execution (RCE) through external requests. This issue arises only if the application code contains a prototype pollution vulnerability, which can be exploited in a two-step attack, with the second step triggering unauthorized RCE on the remote server. Applications using Declarative Mode or Data Mode are not affected.

Impact

Exploitation of this vulnerability could lead to unauthorized remote code execution on the server where the application is running.

Remediation

Users can upgrade to React Router version 7.14.2 or later to address this vulnerability.