remix-run

Records31All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high14CVSS 7.0–8.9

Exploited now

remix-run records in CISA KEV

No remix-run vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

React-router 16 records MEDIUM Remix-run/react 4 records LOW Hydrogen 1 record LOW Koa-shopify-auth 1 record LOW React-router/node 1 record MEDIUM Remix-run/deno 1 record MEDIUM Remix-run/node 1 record MEDIUM Remix-run/server-runtime 1 record LOW

Records

31 records

TI-2025-28449 CVE-2025-43865 · GHSA-cpj6-fhp6-mr6j

React Router allows pre-render data spoofing on React-Router framework mode

HIGH 75

React Router is a router for React.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00815 Published 2025-04-25 Partial fix · 7.5.2 CWE-345

TI-2025-28448 CVE-2025-43864 · GHSA-f46r-rw29-r322

React Router allows a DoS via cache poisoning by forcing SPA mode

HIGH 72

React Router is a router for React.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.20475 Published 2025-04-25 Fixed in 7.5.2 CWE-755

TI-2025-38117 CVE-2025-61686 · GHSA-9583-h5hc-x8cw

React Router has Path Traversal in File Session Storage

MEDIUM 62

React Router is a router for React.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.17346 Published 2026-01-10 Fixed in 7.9.4, 2.17.2 CWE-22

TI-2026-40200 CVE-2026-55685 · GHSA-chx6-hx7r-mcp5

React Router: Unauthenticated Denial of Service via Inefficient Route Matching

MEDIUM 45

React Router is a router for React.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00708 Published 2026-07-27 Partial fix · 7.18.0 CWE-400

TI-2025-33550 CVE-2025-53623 · GHSA-6qjf-g333-pv38

Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class

MEDIUM 45

The Job Iteration API is an an extension for ActiveJob that make jobs interruptible and resumable Versions prior to 1.11.0 have an arbitrary code execution vulnerability in the `CsvEnumerator` class.

CVSS 4.0HIGH 8.1 Network No auth No interaction EPSS 0.00833 Published 2025-07-14 Fixed in 1.11.0, 1.11 CWE-78

TI-2026-26385 CVE-2026-34060 · GHSA-c4r5-fxqw-vh93

Ruby LSP has arbitrary code execution through branch setting

MEDIUM 40

Ruby LSP is an implementation of the language server protocol for Ruby.

CVSS 4.0HIGH 7.1 Local No auth User interaction EPSS 0.00497 Published 2026-03-31 Fixed in 0.26.9, 0.10.2 CWE-94

TI-2026-30645 CVE-2026-42342 · GHSA-8x6r-g9mw-2r78

React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

LOW 39

React Router is a router for React.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00299 Published 2026-06-02 Partial fix · 7.15.0, 2.17.5 CWE-400

TI-2026-26400 CVE-2026-34077 · GHSA-rxv8-25v2-qmq8

React Router vulnerable to Denial of Service via reflected user input in single-fetch

LOW 39

React Router is a router for React.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00294 Published 2026-06-02 Partial fix · 7.14.0, 3.0.0 CWE-770

TI-2026-17723 CVE-2026-22029 · GHSA-2w69-qvjg-hvjx

React Router vulnerable to XSS via Open Redirects

LOW 38

React Router is a router for React.

CVSS 3.1HIGH 8.0 Network No auth User interaction EPSS 0.00866 Published 2026-01-10 Partial fix · 7.12.0, 1.23.2 CWE-79

TI-2026-17585 CVE-2026-21884 · GHSA-8v8x-cx79-35w7

React Router SSR XSS in ScrollRestoration

LOW 38

React Router is a router for React.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00531 Published 2026-01-10 Fixed in 7.12.0, 2.17.3 CWE-79

TI-2026-83448 CVE-2026-63414

Shopify App token exchange flaw lets attackers reach other shops

LOW 37

Shopify App is a Rails engine for building Shopify applications.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00749 Published 2026-10-30 Fixed in 23.0.3 CWE-863

TI-2026-30532 CVE-2026-42211 · GHSA-49rj-9fvp-4h2h

Deserialization of untrusted data in remix-run react-router

LOW 37

React Router is a router for React.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00416 Published 2026-06-02 Partial fix · 7.14.2 CWE-502

TI-2026-28995 CVE-2026-40181 · GHSA-2j2x-hqr9-3h42

Open redirect in remix-run react-router

LOW 35

React Router is a router for React.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00221 Published 2026-06-02 Partial fix · 7.14.1, 6.30.4 +1 CWE-601

TI-2025-22398 CVE-2025-31137 · GHSA-4q56-crqp-v477

Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers

LOW 35

React Router is a multi-strategy router for React bridging the gap from React 18 to React 19.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01191 Published 2025-04-01 Partial fix · 7.4.1, 2.16.3 CWE-444

TI-2026-25663 CVE-2026-33245 · GHSA-8646-j5j9-6r62

React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

LOW 34

React Router is a router for React.

CVSS 3.1HIGH 8.0 Network No auth User interaction EPSS 0.00189 Published 2026-06-02 Partial fix · 7.13.2 CWE-79

TI-2025-36699 CVE-2025-59057 · GHSA-3cgp-3xvw-98x8

React Router has XSS Vulnerability

LOW 34

React Router is a router for React.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00503 Published 2026-01-10 Fixed in 7.9.0, 2.17.1 CWE-79

TI-2025-30440 CVE-2025-48069 · GHSA-2c47-m757-32g6

ejson2env has insufficient input sanitization

LOW 34

ejson2env allows users to decrypt EJSON secrets and export them as environment variables.

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.01424 Published 2025-05-21 Fixed in 2.0.8 CWE-78

TI-2026-28743 CVE-2026-39862

Tophat has a Command Injection Vulnerability When Accessing a Maliciously Crafted Tophat Link

LOW 31

Tophat is a mobile applications testing harness.

CVSS 4.0MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00577 Published 2026-04-08 Fixed in 2.5.1 CWE-78

TI-2026-38707 CVE-2026-53668 · GHSA-jjmj-jmhj-qwj2

React Router: Open redirect can lead to XSS

LOW 30

React Router is a router for React.

CVSS 3.1MEDIUM 6.9 Network No auth User interaction EPSS 0.00341 Published 2026-07-27 Partial fix · 7.13.0, 6.30.6 CWE-601

TI-2026-38706 CVE-2026-53667 · GHSA-h8fp-f39c-q6mh

Cross-site scripting in remix-run react-router

LOW 30

React Router is a router for React.

CVSS 3.1MEDIUM 6.9 Network No auth User interaction EPSS 0.00355 Published 2026-07-27 Partial fix · 7.18.0 CWE-79

TI-2022-11773 CVE-2022-29230 · GHSA-6j22-wv8g-894f

Potential cross-site scripting (XSS) vulnerability in Hydrogen

LOW 30

Hydrogen is a React-based framework for building dynamic, Shopify-powered custom storefronts.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00832 Published 2022-05-18 Fixed in 0.19.0 CWE-79

TI-2026-38708 CVE-2026-53669 · GHSA-wrjc-x8rr-h8h6

React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

LOW 29

React Router is a router for React.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00319 Published 2026-07-27 Partial fix · 7.18.0 CWE-601

TI-2025-42000 CVE-2025-68470 · GHSA-9jcx-v3wj-wh4m

React Router has unexpected external redirect via untrusted paths

LOW 29

React Router is a router for React.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00492 Published 2026-01-10 Partial fix · 7.9.6, 6.30.2 CWE-601

TI-2020-06594 CVE-2020-8176 · GHSA-jqh7-w5pr-cr56

Cross-site scripting in koa-shopify-auth

LOW 29

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the `shop` parameter on the `/shopify/auth/enable_cookies` endpoint.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00984 Published 2020-07-02 Fixed in 3.1.63 CWE-79

TI-2026-38705 CVE-2026-53666 · GHSA-337j-9hxr-rhxg

React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

LOW 28

React Router is a router for React.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0042 Published 2026-07-27 Partial fix · 7.18.0 CWE-470

Open these records in search →