| Package | Affected versions | Patched versions |
|---|---|---|
| react-router | ≥ 7.0.0, < 7.14.2 | 7.14.2 |
| react-router | ≥ 7.0.0, < 7.14.2 | 7.14.2 |
When using React Router v7 in Framework Mode, there exists a combination of steps that could potentially allow unauthorized RCE through external requests. This first requires the application code to have an existing prototype pollution vulnerability. This can be leveraged into a 2-step attack in which the second step can trigger unauthorized RCE on the remote server.
[!NOTE] This does not impact your React Router application if you are using Declarative Mode (
<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free