React Router, when used with Remix’s server‑side route action handlers in Framework Mode or with React Server Actions in unstable RSC modes, is vulnerable to cross‑site request forgery. The flaw allows an attacker to submit forged POST requests to UI routes, triggering privileged server‑side actions without additional authentication tokens. This weakness is identified as CWE‑352 and has an additional relation to CWE‑346. The impact is the ability to perform unauthorized state changes or data manipulation on behalf of an authenticated user.

Affected components include the @remix‑run/server‑runtime package versions older than 2.17.3 and react‑router package versions 7.0.0 through 7.11.0. The vulnerability does not apply when the application uses Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). The issue is limited to Node.js running these packages, so only applications built with those stack elements are at risk.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1 % suggests a low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker sending forged POST requests to the application’s UI routes, which usually requires that a user is authenticated and is tricked into visiting a malicious link or submitting a form. Under these conditions, the practical risk to most deployments remains moderate, but deployments using the vulnerable modes should patch or mitigate promptly.