CVE-2026-42211

A flaw was found in React Router when operating in Framework Mode. A remote attacker could exploit an existing prototype pollution vulnerability within the application code. This could lead to unauthorized remote code execution (RCE) on the server through a two-step attack involving external requests. This vulnerability poses a significant risk, potentially allowing an attacker to take control of the affected system.

An Important remote code execution flaw exists in React Router versions 7.0.0 through 7.14.1 when utilized in Framework Mode. This vulnerability requires an existing prototype pollution flaw within the application to enable a two-step attack, leading to unauthorized remote code execution on the server. Red Hat products employing React Router in Declarative Mode or Data Mode are not impacted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, ensure that applications using React Router are not configured in Framework Mode. Instead, utilize Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>), as these modes are not susceptible to this flaw.