shopify remix-runreact vulnerabilities

Latest shopify remix-runreact CVEs

Newest publication first

1. CVE-2026-22030 React Router has CSRF issue in Action/Server Action Request Processing

   Published 2026-01-10

   Medium·CVSS 6.5 EPSS 0.19%

   React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framewo...

2. CVE-2026-22029 React Router vulnerable to XSS via Open Redirects

   Published 2026-01-10

   Medium·CVSS 6.1 EPSS 0.87%

   React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can res...

3. CVE-2026-21884 React Router SSR XSS in ScrollRestoration

   Published 2026-01-10

   High·CVSS 8.2 EPSS 0.53%

   React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering wh...

4. CVE-2025-59057 React Router has XSS Vulnerability

   Published 2026-01-10

   High·CVSS 7.6 EPSS 0.50%

   React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitr...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.