React Router is a router for React. In @remix-run/router versions prior to 1.23.2 and react‑router 7.0.0 through 7.11.0, open navigation redirects that originate from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs that cause unintended JavaScript execution on the client. The vulnerability only applies when redirect paths are constructed from untrusted content or via an open redirect; Declarative Mode (<BrowserRouter>) is not affected. This is a cross‑site scripting flaw (CWE‑79). The impact is that an attacker can execute arbitrary code on the client without needing other privileges.

Vendors: remix‑run (React Router). Affected versions are @remix‑run/router before 1.23.2 and react‑router versions 7.0.0 through 7.11.0. Versions 1.23.2 and 7.12.0 and later contain the fix. If Declarative Mode (<BrowserRouter>) is used, the issue does not apply.

The CVSS score is 8, indicating a high severity. The EPSS score is less than 1%, showing a very low exploit probability as of the data available. The vulnerability is not listed in CISA’s KEV catalog. Attack likely requires that an attacker can influence the redirect URL in a loader or action; the attack vector is user‑directed through a link that the victim clicks. Successful exploitation permits arbitrary JavaScript execution in the victim’s browser, providing opportunities for phishing, credential theft, or further client‑side attacks.