React Router (Remix) allows attackers to trigger client‑side script execution by exploiting open redirects that originate from loaders or actions in Framework, Data, or unstable RSC modes. The vulnerability occurs when a redirect URL is constructed from untrusted content, leading to unsafe JavaScript that executes in the user’s browser. This is an example of a cross‑site scripting flaw (CWE‑79). The impact is that an attacker can execute arbitrary code on the client without needing other privileges.

Vendors: remix‑run (React Router). Affected versions are @remix‑run/router before 1.23.2 and react‑router versions 7.0.0 through 7.11.0. Versions 1.23.2 and 7.12.0 and later contain the fix. If Declarative Mode (<BrowserRouter>) is used, the issue does not apply.

The CVSS score is 8, indicating a high severity. The EPSS score is less than 1%, showing a very low exploit probability as of the data available. The vulnerability is not listed in CISA’s KEV catalog. Attack likely requires that an attacker can influence the redirect URL in a loader or action; the attack vector is user‑directed through a link that the victim clicks. Successful exploitation permits arbitrary JavaScript execution in the victim’s browser, providing opportunities for phishing, credential theft, or further client‑side attacks.