ReactRouter @remix-run/router<1.23.2/ReactRouter<7.12.0 OpenURL to JS Exec
CVE-2026-22029 Published on January 10, 2026

React Router vulnerable to XSS via Open Redirects
React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<BrowserRouter>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.

Github Repository NVD

Vulnerability Analysis

CVE-2026-22029 can be exploited with network access, requires user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

HIGH

Privileges Required:

NONE

User Interaction:

REQUIRED

Scope:

CHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

HIGH

Availability Impact:

NONE

Weakness Type

What is a XSS Vulnerability?

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE-2026-22029 has been classified to as a XSS vulnerability or weakness.

Products Associated with CVE-2026-22029

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Ansible Automation Platform

Red Hat Ansible Automation Platform Developer

Red Hat Ansible Automation Platform Inside

Red Hat Acm

Red Hat Advanced Cluster Security

Red Hat Discovery

Red Hat Openshift Ai

Red Hat Openshift

Red Hat Openshift Devspaces

Red Hat Service Mesh

Red Hat Openshift Data Foundation

Red Hat Trusted Artifact Signer

Red Hat Multicluster Engine

Red Hat Logging

Red Hat Rhmt

Red Hat Migration Toolkit Virtualization

Red Hat Openshift Lightspeed

Red Hat Openshift Pipelines

Red Hat Service Registry

Red Hat Connectivity Link

Red Hat Jboss Data Grid

Red Hat Rhdh

Red Hat Edge Manager

Red Hat Jboss Fuse

Red Hat Openshift Distributed Tracing

Red Hat Openshift Gitops

Red Hat Container Native Virtualization

Red Hat Jboss Enterprise Bpms Platform

Red Hat Quay

Red Hat Single Sign On

Red Hat Cryostat

Red Hat Gatekeeper

Red Hat Migration Toolkit Applications

Red Hat Network Observ Optr

Red Hat Workload Availability Nhc

Red Hat Apache Camel Hawtio

Red Hat Kueue Operator

Red Hat Optaplanner

Red Hat Enterprise Linux (RHEL)

Red Hat Jboss Enterprise Application Platform

Red Hat Jbosseapxp

Red Hat Satellite

Affected Versions

remix-run react-router:

Version >= 7.0.0, < 7.12.0 is affected.

@remix-run/router:

Version < 1.23.2 is affected.

Red Hat Ansible Automation Platform 2.5 for RHEL 8:

Version 0:2.5.20260225-1.el8ap and below * is unaffected.

Red Hat Ansible Automation Platform 2.5 for RHEL 9:

Version 0:2.5.20260225-1.el9ap and below * is unaffected.

Red Hat Ansible Automation Platform 2.6 for RHEL 9:

Version 0:2.6.6-1.el9ap and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.10:

Version 1777128790 and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.6:

Version 1776223790 and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.7:

Version 1773100128 and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.8:

Version 1775116156 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.11:

Version 1783350952 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.12:

Version 1773259174 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.13:

Version 1775116130 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.14:

Version 1769990632 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.14:

Version 1782693386 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.15:

Version 1776927126 and below * is unaffected.

Red Hat Advanced Cluster Security for Kubernetes 4.8:

Version 1769615659 and below * is unaffected.

Red Hat Advanced Cluster Security for Kubernetes 4.9:

Version 1770074713 and below * is unaffected.
Version 1770250889 and below * is unaffected.

Red Hat Ansible Automation Platform 2.6:

Version 1772543959 and below * is unaffected.

Red Hat Discovery 2:

Version 1770913709 and below * is unaffected.

Red Hat Edge Manager 1.0:

Version 1783502765 and below * is unaffected.

Red Hat Edge Manager 1.0:

Version 1783502438 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784126822 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784127736 and below * is unaffected.

Red Hat OpenShift AI 2.25:

Version 1772093424 and below * is unaffected.

Red Hat OpenShift AI 2.25:

Version 1772093498 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1779189627 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1778473763 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1778666987 and below * is unaffected.

Red Hat OpenShift Container Platform 4.17:

Version 1782269794 and below * is unaffected.

Red Hat OpenShift Container Platform 4.18:

Version 1779874967 and below * is unaffected.

Red Hat OpenShift Container Platform 4.19:

Version 1779256322 and below * is unaffected.

Red Hat OpenShift Container Platform 4.19:

Version 1779249920 and below * is unaffected.

Red Hat OpenShift Container Platform 4.20:

Version 1778645099 and below * is unaffected.

Red Hat OpenShift Container Platform 4.20:

Version 1778645008 and below * is unaffected.

Red Hat OpenShift Container Platform 4.21:

Version 1778539338 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781555717 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781554936 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781555645 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781556009 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781558423 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781555708 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781557202 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781555679 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781557189 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781556534 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781556085 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781555971 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781557158 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781556690 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781558326 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781556544 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781556958 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781556901 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781557496 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1781550255 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1781554417 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1781550415 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1781550593 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1781551060 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1781550551 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1781550615 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1781550670 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1781550777 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1781550759 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1781551276 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1781550761 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1781550908 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1781550957 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1781551499 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1781551098 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1781551130 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1781551169 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1781551235 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1781551472 and below * is unaffected.