Medium

Open-navigation redirect XSS in React Router and @remix-run/router

IdentifiersCVE-2026-22029CWE-79· Improper Neutralization of Input…

CVE-2026-22029 is a client-side cross-site scripting issue in React Router and the underlying @remix-run/router package. In @remix-run/router versions prior to 1.23.2 and react-router versions 7.0.0 through 7.11.0, SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or unstable RSC modes can produce unsafe URLs that lead to unintended JavaScript execution in the browser. The issue occurs when redirect paths are derived from untrusted content or attacker-influenced open redirect input. Declarative Mode using <BrowserRouter> is not affected. The flaw is best characterized as XSS caused by insufficient validation of redirect destinations during client-side navigation handling.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows attacker-controlled JavaScript execution in the victim's browser in the context of the vulnerable application. This can enable session theft, DOM manipulation, credential or token exfiltration, phishing UI injection, and actions performed as the victim within the application. Because exploitation is tied to unsafe redirect handling, impact depends on whether attacker-controlled input can influence redirect targets returned by loaders or actions.

Mitigation

If you can’t patch tonight, do this now.

Do not construct redirect destinations from untrusted or user-controlled input. Validate and normalize redirect targets, enforce allowlists for internal paths or approved origins, and reject javascript: and other unsafe URL schemes. Audit Framework Mode, Data Mode, and unstable RSC mode loaders/actions for attacker-influenced redirect generation. Applications using Declarative Mode (<BrowserRouter>) are not impacted by this issue, but redirect validation remains advisable as a defense-in-depth measure.

Remediation

Patch, then assume compromise.

Upgrade to fixed versions: @remix-run/router 1.23.2 or later and react-router 7.12.0 or later. Review application code that generates redirects from loaders or actions and remove any use of untrusted input when constructing redirect destinations. Where redirects are necessary, constrain them to validated internal routes or a strict allowlist of safe targets.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

ShopifyReact-Routerapplication

ShopifyRemix-Run/Reactapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

8 SOURCESView more in app

atlassian confluenceNews

May 19, 2026

Security Bulletin - May 19 2026 | Atlassian Support | Atlassian Documentation

A DOM-based cross-site scripting vulnerability affecting Jira Software Data Center and Jira Service Management Data Center.

atlassian confluenceNews

Apr 22, 2026

Security Bulletin - April 21 2026 | Atlassian Support | Atlassian Documentation

DOM-based cross-site scripting vulnerability in the @remix-run/router dependency affecting Confluence Data Center.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity6