React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

概要

参考情報

• remix-run/react-router security advisory · WEB
• remix-run/react-router#15353 · WEB
• remix-run/react-router commit 7a71c72 · WEB
• remix-run/react-router commit 8ebd5df · WEB
• remix-run/react-router · PACKAGE
• remix-run/react-router · WEB
• remix-run/react-router · WEB
• remix-run/react-router release [email protected] · WEB
• remix-run/react-router release [email protected] · WEB
• remix-run/react-router#15311 · WEB

react-router のその他の脆弱性

• CVE-2026-55685高 7.5React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted r…
• CVE-2026-53669中 6.1React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in <Link> and …
• CVE-2026-53668中 6.9React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are v…
• CVE-2026-53667中 6.1React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redi…
• CVE-2026-53666中 6.1React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied…