« Volver al listado

CVE-2026-42211

Estado: AnalizadaAlta (8.1)—

React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.14.2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N sin privilegios permite explotación remota (T1190); la RCE confirmada en descripción se mapea como T1059. Requiere PR:N y vulnerabilidad preexistente de prototype pollution.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementVulnerability ScanningRestrict Web-Based ContentNetwork SegmentationLimit Software InstallationLimit Access to Resource Over Network

Tecnologías afectadas (1)

Shopify — React-router

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-42211",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-42211",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-03T14:01:21.166754Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "remix-run",
          "product": "react-router",
          "versions": [
            {
              "status": "affected",
              "version": ">= 7.0.0, < 7.14.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-02T20:16:36.537",
  "references": [
    {
      "url": "https://github.com/remix-run/react-router/security/advisories/GHSA-49rj-9fvp-4h2h",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.14.2."
    },
    {
      "lang": "es",
      "value": "React Router es un router para React. En las versiones 7.0.0 a 7.14.1, al usar el Framework Mode, una combinación de pasos podría potencialmente permitir la ejecución remota de código (RCE) no autorizada a través de solicitudes externas. Este ataque requiere que el código de la aplicación tenga una vulnerabilidad de contaminación de prototipos existente, la cual puede ser aprovechada en un ataque de 2 pasos donde el segundo paso desencadena RCE no autorizada en el servidor remoto. Esto no tiene impacto en aplicaciones que usan Declarative Mode (' BrowserRouter ') o Data Mode ('createBrowserRouter/ RouterProvider '). Esto está parcheado en la versión 7.14.2."
    }
  ],
  "lastModified": "2026-07-21T19:10:00.107",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "02931B5A-0559-41CC-8566-D6C018538F2C",
              "versionEndExcluding": "7.14.2",
              "versionStartIncluding": "7.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}