CVE-2026-22029: React Router XSS via unsafe SPA navigation redirects

CVE-2026-22029 · Severity: high · CVSS 8 · Published 2026-01-10

React Router is a popular JavaScript library for building single-page applications with client-side navigation. A vulnerability in specific routing modes allows attackers to inject malicious JavaScript code when developers construct redirect URLs from untrusted sources or open redirect scenarios. This could lead to session hijacking, credential theft, or malware distribution to users of affected applications.

Technologies: Shopify Remix-Run\. Vendors: npm, Shopify.

Quick answers

Is CVE-2026-22029 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-22029 being exploited in the wild.
How severe is CVE-2026-22029?
High severity, with a CVSS score of 8, published 10 January 2026.
Which products and versions are affected?
@remix-run/router (npm) SEMVER:introduced=0,fixed=1.23.2; Shopify Remix < 1.23.2.
Is there a fix for CVE-2026-22029?
Yes. @remix-run/router (npm): upgrade to 1.23.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22029 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-22029?
Check whether you run @remix-run/router (npm), Shopify Remix or Shopify Remix-Run\ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @remix-run/router (npm): upgrade to 1.23.2 or later
    npm install @remix-run/router@1.23.2

Technical details

React Router and Remix v1/v2 suffer from a Cross-Site Scripting (CWE-79) vulnerability in Framework Mode, Data Mode, and unstable RSC modes when handling open navigation redirects originating from loaders or actions. The root cause is insufficient sanitization of redirect paths derived from untrusted content or open redirect vulnerabilities. An attacker can craft a malicious redirect URL containing JavaScript (e.g., `javascript:alert()` or data URIs) that executes in the user's browser when the redirect is processed. The vulnerability requires user interaction (navigation trigger) and network access to the application. Declarative Mode applications using `&lt;BrowserRouter&gt;` are not affected. Patches are available: react-router 7.12.0+ and @remix-run/router 1.23.2+.

Affected products

  • Remix react-router 7.0.0 to 7.11.0
  • Remix @remix-run/router < 1.23.2

Identifiers

  • CVE-2026-22029
  • GHSA-2w69-qvjg-hvjx

Timeline

  • 2026-01-08: disclosed: Advisory published
  • 2026-01-08: patched: react-router 7.12.0 and @remix-run/router 1.23.2 patched versions released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.