CVE-2026-42211

React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.14.2.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/remix-run/react-router/security/advisories/GHSA-49rj-9fvp-4h2h	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2026-06-02 20:16

Updated : 2026-07-21 19:10

NVD link : CVE-2026-42211

Mitre link : CVE-2026-42211

CVE.ORG link : CVE-2026-42211

JSON object : View

Products Affected

shopify

react-router

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-42211", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42211", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-03T14:01:21.166754Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "remix-run", "product": "react-router", "versions": [{"status": "affected", "version": ">= 7.0.0, < 7.14.2"}]}]}], "published": "2026-06-02T20:16:36.537", "references": [{"url": "https://github.com/remix-run/react-router/security/advisories/GHSA-49rj-9fvp-4h2h", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.14.2."}, {"lang": "es", "value": "React Router es un router para React. En las versiones 7.0.0 a 7.14.1, al usar el Framework Mode, una combinaci\u00f3n de pasos podr\u00eda potencialmente permitir la ejecuci\u00f3n remota de c\u00f3digo (RCE) no autorizada a trav\u00e9s de solicitudes externas. Este ataque requiere que el c\u00f3digo de la aplicaci\u00f3n tenga una vulnerabilidad de contaminaci\u00f3n de prototipos existente, la cual puede ser aprovechada en un ataque de 2 pasos donde el segundo paso desencadena RCE no autorizada en el servidor remoto. Esto no tiene impacto en aplicaciones que usan Declarative Mode (' BrowserRouter ') o Data Mode ('createBrowserRouter/ RouterProvider '). Esto est\u00e1 parcheado en la versi\u00f3n 7.14.2."}], "lastModified": "2026-07-21T19:10:00.107", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "02931B5A-0559-41CC-8566-D6C018538F2C", "versionEndExcluding": "7.14.2", "versionStartIncluding": "7.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}