CVE-2026-21884

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21884", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-05T17:24:36.928Z", "datePublished": "2026-01-10T02:41:44.944Z", "dateUpdated": "2026-07-15T01:19:46.847Z"}, "containers": {"cna": {"title": "React Router SSR XSS in ScrollRestoration", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/remix-run/react-router/security/advisories/GHSA-8v8x-cx79-35w7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/remix-run/react-router/security/advisories/GHSA-8v8x-cx79-35w7"}], "affected": [{"vendor": "remix-run", "product": "react-router", "versions": [{"version": "@remix-run/react < 2.17.3", "status": "affected"}, {"version": "react-router >= 7.0.0, < 7.12.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-10T02:41:44.944Z"}, "descriptions": [{"lang": "en", "value": "React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. There is no impact if server-side rendering in Framework Mode is disabled, or if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/react version 2.17.3 and react-router version 7.12.0."}], "source": {"advisory": "GHSA-8v8x-cx79-35w7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21884", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-13T04:55:52.068631Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:04:51.084Z"}}, {"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ansible_automation_platform:2.6::el9"], "defaultStatus": "affected", "packageName": "automation-platform-ui", "product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.6.6-1.el9ap", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ansible_automation_platform:2.6::el9"], "defaultStatus": "affected", "packageName": "ansible-automation-platform-26/gateway-rhel9", "product": "Red Hat Ansible Automation Platform 2.6", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1772543959", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-dashboard-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1772093424", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-mod-arch-model-registry-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1772093498", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.3::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-dashboard-rhel9", "product": "Red Hat OpenShift AI 3.3", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1779189627", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.3::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-mod-arch-gen-ai-rhel9", "product": "Red Hat OpenShift AI 3.3", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1778473763", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.3::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-mod-arch-model-registry-rhel9", "product": "Red Hat OpenShift AI 3.3", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1778666987", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:kueue_operator:1"], "defaultStatus": "unaffected", "packageName": "kueue/kueue-must-gather-rhel9", "product": "Red Hat Build of Kueue", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:kueue_operator:1"], "defaultStatus": "unaffected", "packageName": "kueue/kueue-operator-bundle", "product": "Red Hat Build of Kueue", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:kueue_operator:1"], "defaultStatus": "unaffected", "packageName": "kueue/kueue-rhel9", "product": "Red Hat Build of Kueue", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:kueue_operator:1"], "defaultStatus": "unaffected", "packageName": "kueue/kueue-rhel9-operator", "product": "Red Hat Build of Kueue", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "unaffected", "packageName": "ipa", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "unaffected", "packageName": "ipa", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}], "datePublic": "2026-01-10T02:41:44.944Z", "descriptions": [{"lang": "en", "value": "A cross site scripting flaw has been discovered in the npm react-router package. The cross site scripting (XSS) vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-21884"}, {"name": "RHBZ#2428421", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428421"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21884.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:3958"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:3960"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:3782"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:19712"}], "solutions": [{"lang": "en", "value": "RHSA-2026:3958: Red Hat Ansible Automation Platform 2.6 for RHEL 9"}, {"lang": "en", "value": "RHSA-2026:3960: Red Hat Ansible Automation Platform 2.6"}, {"lang": "en", "value": "RHSA-2026:3782: Red Hat OpenShift AI 2.25"}, {"lang": "en", "value": "RHSA-2026:19712: Red Hat OpenShift AI 3.3"}], "timeline": [{"lang": "en", "time": "2026-01-10T04:01:46.246Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-01-10T02:41:44.944Z", "value": "Made public."}], "title": "react-router: @remix-run/react: React Router SSR XSS in ScrollRestoration", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T01:19:46.847Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "react-router: @remix-run/react: React Router SSR XSS in ScrollRestoration", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:ansible_automation_platform:2.6::el9", "cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9", "cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"], "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ansible_automation_platform:2.6::el9"], "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.6", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 2.25", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.3::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.3", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ansible_automation_platform:2.6::el10", "cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10"], "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.6 for RHEL 10", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:kueue_operator:1"], "vendor": "Red Hat", "product": "Red Hat Build of Kueue", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-10T04:01:46.246Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-01-10T02:41:44.944Z", "value": "Made public."}], "solutions": [{"lang": "en", "value": "RHSA-2026:3958: Red Hat Ansible Automation Platform 2.6 for RHEL 9"}, {"lang": "en", "value": "RHSA-2026:3960: Red Hat Ansible Automation Platform 2.6"}, {"lang": "en", "value": "RHSA-2026:3782: Red Hat OpenShift AI 2.25"}, {"lang": "en", "value": "RHSA-2026:19712: Red Hat OpenShift AI 3.3"}], "x_adpType": "supplier", "datePublic": "2026-01-10T02:41:44.944Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-21884", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428421", "name": "RHBZ#2428421", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21884.json", "tags": ["x_sadp-csaf-vex"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:3958", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:3960", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:3782", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:19712", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A cross site scripting flaw has been discovered in the npm react-router package. The cross site scripting (XSS) vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-06-30T02:45:46.845Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21884", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-13T04:55:52.068631Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T18:11:06.386Z"}}], "cna": {"title": "React Router SSR XSS in ScrollRestoration", "source": {"advisory": "GHSA-8v8x-cx79-35w7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "remix-run", "product": "react-router", "versions": [{"status": "affected", "version": "@remix-run/react < 2.17.3"}, {"status": "affected", "version": "react-router >= 7.0.0, < 7.12.0"}]}], "references": [{"url": "https://github.com/remix-run/react-router/security/advisories/GHSA-8v8x-cx79-35w7", "name": "https://github.com/remix-run/react-router/security/advisories/GHSA-8v8x-cx79-35w7", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. There is no impact if server-side rendering in Framework Mode is disabled, or if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/react version 2.17.3 and react-router version 7.12.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-10T02:41:44.944Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21884", "state": "PUBLISHED", "dateUpdated": "2026-06-30T02:45:46.845Z", "dateReserved": "2026-01-05T17:24:36.928Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-10T02:41:44.944Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "react-router", "vendor": "remix-run", "versions": [{"status": "affected", "version": "@remix-run/react < 2.17.3"}, {"status": "affected", "version": "react-router >= 7.0.0, < 7.12.0"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ansible_automation_platform:2.6::el9"], "defaultStatus": "affected", "packageName": "automation-platform-ui", "product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.6.6-1.el9ap", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:ansible_automation_platform:2.6::el9"], "defaultStatus": "affected", "packageName": "ansible-automation-platform-26/gateway-rhel9", "product": "Red Hat Ansible Automation Platform 2.6", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1772543959", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-dashboard-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1772093424", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-mod-arch-model-registry-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1772093498", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.3::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-dashboard-rhel9", "product": "Red Hat OpenShift AI 3.3", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1779189627", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.3::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-mod-arch-gen-ai-rhel9", "product": "Red Hat OpenShift AI 3.3", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1778473763", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.3::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-mod-arch-model-registry-rhel9", "product": "Red Hat OpenShift AI 3.3", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1778666987", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:kueue_operator:1"], "defaultStatus": "unaffected", "packageName": "kueue/kueue-must-gather-rhel9", "product": "Red Hat Build of Kueue", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:kueue_operator:1"], "defaultStatus": "unaffected", "packageName": "kueue/kueue-operator-bundle", "product": "Red Hat Build of Kueue", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:kueue_operator:1"], "defaultStatus": "unaffected", "packageName": "kueue/kueue-rhel9", "product": "Red Hat Build of Kueue", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:kueue_operator:1"], "defaultStatus": "unaffected", "packageName": "kueue/kueue-rhel9-operator", "product": "Red Hat Build of Kueue", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "unaffected", "packageName": "ipa", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "unaffected", "packageName": "ipa", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "6928DE33-6137-4682-8610-1A6646F1B2A5", "versionEndIncluding": "7.11.0", "versionStartIncluding": "7.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:shopify:remix-run\\/react:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "CD7006C4-2033-446C-A472-DAD51EB06396", "versionEndExcluding": "2.17.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. There is no impact if server-side rendering in Framework Mode is disabled, or if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/react version 2.17.3 and react-router version 7.12.0."}, {"lang": "es", "value": "React Router es un router para React. En la versi\u00f3n de @remix-run/react anterior a la 2.17.3 y react-router de la 7.0.0 a la 7.11.0, existe una vulnerabilidad de XSS en la API de React Router en Modo Framework al usar las props getKey/storageKey durante la Renderizaci\u00f3n del Lado del Servidor, lo que podr\u00eda permitir la ejecuci\u00f3n arbitraria de JavaScript durante SSR si se utiliza contenido no confiable para generar las claves. No hay impacto si la renderizaci\u00f3n del lado del servidor en Modo Framework est\u00e1 deshabilitada, o si se est\u00e1 utilizando el Modo Declarativo () o el Modo de Datos (createBrowserRouter/). Este problema ha sido parcheado en la versi\u00f3n 2.17.3 de @remix-run/react y la versi\u00f3n 7.12.0 de react-router."}], "id": "CVE-2026-21884", "lastModified": "2026-07-15T02:18:31.757", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.7, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21884", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-13T04:55:52.068631Z", "version": "2.0.3"}}]}, "published": "2026-01-10T03:15:48.673", "references": [{"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/remix-run/react-router/security/advisories/GHSA-8v8x-cx79-35w7"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:19712"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:3782"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:3958"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:3960"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-21884"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428421"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21884.json"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "react-router: @remix-run/react: React Router SSR XSS in ScrollRestoration", "id": "2428421", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428421"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["No description is available for this CVE."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-21884", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-26/gateway-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "automation-platform-ui", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:kueue_operator:1", "fix_state": "Affected", "package_name": "kueue/kueue-must-gather-rhel9", "product_name": "Red Hat Build of Kueue"}, {"cpe": "cpe:/a:redhat:kueue_operator:1", "fix_state": "Affected", "package_name": "kueue/kueue-operator-bundle", "product_name": "Red Hat Build of Kueue"}, {"cpe": "cpe:/a:redhat:kueue_operator:1", "fix_state": "Affected", "package_name": "kueue/kueue-rhel9", "product_name": "Red Hat Build of Kueue"}, {"cpe": "cpe:/a:redhat:kueue_operator:1", "fix_state": "Affected", "package_name": "kueue/kueue-rhel9-operator", "product_name": "Red Hat Build of Kueue"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "ipa", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "ipa", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-dashboard-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-mod-arch-gen-ai-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-mod-arch-model-registry-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-01-10T02:41:44Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-21884\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-21884\nhttps://github.com/remix-run/react-router/security/advisories/GHSA-8v8x-cx79-35w7"], "threat_severity": "Important"}

{"analysis": {"en": {"generated_at": "2026-04-18T07:15:17.549877+00:00", "value": {"mitigation_remediation": ["Upgrade @remix\u2011run/react to version 2.17.3 or newer and react\u2011router to version 7.12.0 or newer.", "If upgrading is not immediately possible, disable Framework Mode server\u2011side rendering or avoid using <ScrollRestoration> with untrusted key data, and switch to Declarative or Data Mode usage if applicable.", "Implement strict validation or encoding for any data that is used to set getKey or storageKey properties to prevent injection of malicious scripts."], "summary": {"action": "Immediate Patch", "impact": "Cross\u2011Site Scripting during Server\u2011Side Rendering"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the @remix\u2011run/react package up to version 2.17.2 and the react\u2011router package from 7.0.0 through 7.11.0. Systems using these libraries in Framework Mode with <ScrollRestoration> must upgrade to @remix\u2011run/react 2.17.3 or later and react\u2011router 7.12.0 or later to eliminate the flaw.", "description_and_impact": "React Router's <ScrollRestoration> component in Framework Mode is vulnerable to cross\u2011site scripting when the getKey or storageKey properties are populated using untrusted content. If an attacker can supply malicious data that is used to generate these keys, arbitrary JavaScript can be executed on the server side and rendered to the client. The weakness is an input validation flaw, identified as CWE\u201179, and the primary impact is the ability to run malicious scripts in the browser context of users compiling the SSR output.", "risk_and_exploitability": "The CVSS base score of 8.2 indicates a high severity vulnerability. The EPSS score is reported at less than 1%, suggesting low exploitation probability, and the issue is not listed in the CISA KEV catalog. The most likely attack vector is through server\u2011side rendering of user\u2011controlled content in Framework Mode, where the component generates keys from untrusted data. Exploitation would require that the attacker has the ability to influence the content used to build the keys, but no additional credentials or privileges are necessary."}}}}, "created": "2026-04-18T07:15:25.862602+00:00", "updated": "2026-04-18T07:15:25.862613+00:00", "vendors": []}