React Router versions 7.0.0 through 7.14.1 contain a flaw that allows an attacker to execute arbitrary code via the vendored turbo-stream library. When the application is running in Framework Mode and is exposed to external requests, an attacker can exploit an existing prototype pollution vulnerability in a two‑step attack. The attacker first pollutes the object prototype, then triggers the compromised turbo-stream deserialization process, which arbitrarily invokes a constructor and compromises the application with remote code execution. The vulnerability allows arbitrary code execution within the context of the running application.

The vulnerability affects the Remix‑run React Router package. All releases from 7.0.0 through 7.14.1 carried the flaw when running in Framework Mode. Declarative Mode usage via <BrowserRouter> and Data Mode via createBrowserRouter/RouterProvider are not impacted. The fix is applied in version 7.14.2.

The CVSS score of 8.1 indicates a high severity condition. EPSS information is not available, and the vulnerability is not currently listed in the CISA KEV catalog, which suggests that out‑of‑band exploitation has not yet been observed. The attack vector requires the application code to have a pre‑existing prototype pollution flaw, making the overall exploitability dependent on the presence of that secondary vulnerability. If both conditions are met, an attacker can gain unrestricted control of the target system.