Vulnerabilities

TI-2026-83448 CVE-2026-63414

Shopify App token exchange flaw lets attackers reach other shops

LOW 37

Shopify App is a Rails engine for building Shopify applications.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00749 Published 2026-10-30 Fixed in 23.0.3 CWE-863

TI-2026-35561 CVE-2026-48122

Workspace settings can override executable and Gemfile paths used by the Ruby LSP VS Code extension

LOW 26

Ruby LSP is an implementation of the language server protocol for Ruby.

CVSS 4.0MEDIUM 5.4 Local Low privileges User interaction EPSS 0.0018 Published 2026-08-07 Fixed in 0.10.4 CWE-78

TI-2026-38708 CVE-2026-53669 · GHSA-wrjc-x8rr-h8h6

React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

LOW 29

React Router is a router for React.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00319 Published 2026-07-27 Partial fix · 7.18.0 CWE-601

TI-2026-40200 CVE-2026-55685 · GHSA-chx6-hx7r-mcp5

React Router: Unauthenticated Denial of Service via Inefficient Route Matching

MEDIUM 45

React Router is a router for React.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00708 Published 2026-07-27 Partial fix · 7.18.0 CWE-400

TI-2026-38707 CVE-2026-53668 · GHSA-jjmj-jmhj-qwj2

React Router: Open redirect can lead to XSS

LOW 30

React Router is a router for React.

CVSS 3.1MEDIUM 6.9 Network No auth User interaction EPSS 0.00341 Published 2026-07-27 Partial fix · 7.13.0, 6.30.6 CWE-601

TI-2026-38706 CVE-2026-53667 · GHSA-h8fp-f39c-q6mh

Cross-site scripting in remix-run react-router

LOW 30

React Router is a router for React.

CVSS 3.1MEDIUM 6.9 Network No auth User interaction EPSS 0.00355 Published 2026-07-27 Partial fix · 7.18.0 CWE-79

TI-2026-38705 CVE-2026-53666 · GHSA-337j-9hxr-rhxg

React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

LOW 28

React Router is a router for React.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0042 Published 2026-07-27 Partial fix · 7.18.0 CWE-470

TI-2026-38704 CVE-2026-53663 · GHSA-84g9-w2xq-vcv6

React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass

LOW 14

React Router is a router for React.

CVSS 3.1LOW 3.1 Network No auth User interaction EPSS 0.00148 Published 2026-06-22 Partial fix · 7.15.1, 2.17.5 CWE-352

TI-2026-30645 CVE-2026-42342 · GHSA-8x6r-g9mw-2r78

React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

LOW 39

React Router is a router for React.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00299 Published 2026-06-02 Partial fix · 7.15.0, 2.17.5 CWE-400

TI-2026-30532 CVE-2026-42211 · GHSA-49rj-9fvp-4h2h

Deserialization of untrusted data in remix-run react-router

LOW 37

React Router is a router for React.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00416 Published 2026-06-02 Partial fix · 7.14.2 CWE-502

TI-2026-28995 CVE-2026-40181 · GHSA-2j2x-hqr9-3h42

Open redirect in remix-run react-router

LOW 35

React Router is a router for React.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00221 Published 2026-06-02 Partial fix · 7.14.1, 6.30.4 +1 CWE-601

TI-2026-26400 CVE-2026-34077 · GHSA-rxv8-25v2-qmq8

React Router vulnerable to Denial of Service via reflected user input in single-fetch

LOW 39

React Router is a router for React.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00294 Published 2026-06-02 Partial fix · 7.14.0, 3.0.0 CWE-770

TI-2026-25663 CVE-2026-33245 · GHSA-8646-j5j9-6r62

React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

LOW 34

React Router is a router for React.

CVSS 3.1HIGH 8.0 Network No auth User interaction EPSS 0.00189 Published 2026-06-02 Partial fix · 7.13.2 CWE-79

TI-2026-25662 CVE-2026-33244 · GHSA-f22v-gfqf-p8f3

React Router has stored XSS via unescaped Location header in prerendered redirect HTML

LOW 23

React Router is a router for React.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00144 Published 2026-06-02 Partial fix · 7.13.2 CWE-79

TI-2026-28743 CVE-2026-39862

Tophat has a Command Injection Vulnerability When Accessing a Maliciously Crafted Tophat Link

LOW 31

Tophat is a mobile applications testing harness.

CVSS 4.0MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00577 Published 2026-04-08 Fixed in 2.5.1 CWE-78

TI-2026-26385 CVE-2026-34060 · GHSA-c4r5-fxqw-vh93

Ruby LSP has arbitrary code execution through branch setting

MEDIUM 40

Ruby LSP is an implementation of the language server protocol for Ruby.

CVSS 4.0HIGH 7.1 Local No auth User interaction EPSS 0.00497 Published 2026-03-31 Fixed in 0.26.9, 0.10.2 CWE-94

TI-2026-17724 CVE-2026-22030 · GHSA-h5cw-625j-3rxh

React Router has CSRF issue in Action/Server Action Request Processing

LOW 28

React Router is a router for React.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00186 Published 2026-01-10 Partial fix · 7.12.0, 2.17.3 CWE-346

TI-2026-17723 CVE-2026-22029 · GHSA-2w69-qvjg-hvjx

React Router vulnerable to XSS via Open Redirects

LOW 38

React Router is a router for React.

CVSS 3.1HIGH 8.0 Network No auth User interaction EPSS 0.00866 Published 2026-01-10 Partial fix · 7.12.0, 1.23.2 CWE-79

TI-2026-17585 CVE-2026-21884 · GHSA-8v8x-cx79-35w7

React Router SSR XSS in ScrollRestoration

LOW 38

React Router is a router for React.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00531 Published 2026-01-10 Fixed in 7.12.0, 2.17.3 CWE-79

TI-2025-38117 CVE-2025-61686 · GHSA-9583-h5hc-x8cw

React Router has Path Traversal in File Session Storage

MEDIUM 62

React Router is a router for React.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.17346 Published 2026-01-10 Fixed in 7.9.4, 2.17.2 CWE-22

TI-2025-36699 CVE-2025-59057 · GHSA-3cgp-3xvw-98x8

React Router has XSS Vulnerability

LOW 34

React Router is a router for React.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00503 Published 2026-01-10 Fixed in 7.9.0, 2.17.1 CWE-79

TI-2025-42000 CVE-2025-68470 · GHSA-9jcx-v3wj-wh4m

React Router has unexpected external redirect via untrusted paths

LOW 29

React Router is a router for React.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00492 Published 2026-01-10 Partial fix · 7.9.6, 6.30.2 CWE-601

TI-2025-33550 CVE-2025-53623 · GHSA-6qjf-g333-pv38

Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class

MEDIUM 45

The Job Iteration API is an an extension for ActiveJob that make jobs interruptible and resumable Versions prior to 1.11.0 have an arbitrary code execution vulnerability in the `CsvEnumerator` class.

CVSS 4.0HIGH 8.1 Network No auth No interaction EPSS 0.00833 Published 2025-07-14 Fixed in 1.11.0, 1.11 CWE-78

TI-2025-30440 CVE-2025-48069 · GHSA-2c47-m757-32g6

ejson2env has insufficient input sanitization

LOW 34

ejson2env allows users to decrypt EJSON secrets and export them as environment variables.

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.01424 Published 2025-05-21 Fixed in 2.0.8 CWE-78

TI-2025-28449 CVE-2025-43865 · GHSA-cpj6-fhp6-mr6j

React Router allows pre-render data spoofing on React-Router framework mode

HIGH 75

React Router is a router for React.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00815 Published 2025-04-25 Partial fix · 7.5.2 CWE-345

Vulnerabilities

Filters