Shopify
Shopify React-router: vulnerabilidades y CVE
Shopify React-router tiene 16 vulnerabilidades publicadas, 16 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE16
Últimos 12 meses16
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-55685 | Alta (8.7) | 0.71% | — | 27 jul 2026 | React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times.… |
| CVE-2026-53669 | Media (5.1) | 0.32% | — | 27 jul 2026 | React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in <Link> and useNavigate. This issue is a follow up to CVE-2025-68470 and has been fixed in… |
| CVE-2026-53668 | Media (6.9) | 0.34% | — | 27 jul 2026 | React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users… |
| CVE-2026-53667 | Media (6.1) | 0.36% | — | 27 jul 2026 | React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and… |
| CVE-2026-53666 | Media (6.1) | 0.42% | — | 27 jul 2026 | React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then… |
| CVE-2026-42342 | Alta (7.5) | 0.46% | — | 2 jun 2026 | React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain crafted requests can consume disproportionate server… |
| CVE-2026-42211 | Alta (8.1) | 0.62% | — | 2 jun 2026 | React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This… |
| CVE-2026-40181 | Media (6.6) | 0.26% | — | 2 jun 2026 | React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting… |
| CVE-2026-34077 | Alta (7.5) | 0.45% | — | 2 jun 2026 | React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in… |
| CVE-2026-33245 | Media (4.7) | 0.23% | — | 2 jun 2026 | React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in… |
| CVE-2026-33244 | Media (5.4) | 0.14% | — | 2 jun 2026 | React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the HTTP `Location` header value can permit Cross-Site Scripting… |
| CVE-2026-22030 | Media (6.5) | 0.19% | — | 10 ene 2026 | React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI… |
| CVE-2026-22029 | Media (6.1) | 0.88% | — | 10 ene 2026 | React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in… |
| CVE-2026-21884 | Alta (8.2) | 0.54% | — | 10 ene 2026 | React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when… |
| CVE-2025-68470 | Media (6.5) | 0.50% | — | 10 ene 2026 | React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate(), <Link>, or… |
| CVE-2025-59057 | Alta (7.6) | 0.51% | — | 10 ene 2026 | React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode… |