React Router's <ScrollRestoration> component in Framework Mode is vulnerable to cross‑site scripting when the getKey or storageKey properties are populated using untrusted content. If an attacker can supply malicious data that is used to generate these keys, arbitrary JavaScript can be executed on the server side and rendered to the client. The weakness is an input validation flaw, identified as CWE‑79, and the primary impact is the ability to run malicious scripts in the browser context of users compiling the SSR output.

The vulnerability affects the @remix‑run/react package up to version 2.17.2 and the react‑router package from 7.0.0 through 7.11.0. Systems using these libraries in Framework Mode with <ScrollRestoration> must upgrade to @remix‑run/react 2.17.3 or later and react‑router 7.12.0 or later to eliminate the flaw.

The CVSS base score of 8.2 indicates a high severity vulnerability. The EPSS score is reported at less than 1%, suggesting low exploitation probability, and the issue is not listed in the CISA KEV catalog. The most likely attack vector is through server‑side rendering of user‑controlled content in Framework Mode, where the component generates keys from untrusted data. Exploitation would require that the attacker has the ability to influence the content used to build the keys, but no additional credentials or privileges are necessary.