CVE-2026-42211

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42211", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-25T05:04:37.028Z", "datePublished": "2026-06-02T18:18:46.706Z", "dateUpdated": "2026-06-03T14:08:30.154Z"}, "containers": {"cna": {"title": "React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE", "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "lang": "en", "description": "CWE-502: Deserialization of Untrusted Data", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/remix-run/react-router/security/advisories/GHSA-49rj-9fvp-4h2h", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/remix-run/react-router/security/advisories/GHSA-49rj-9fvp-4h2h"}], "affected": [{"vendor": "remix-run", "product": "react-router", "versions": [{"version": ">= 7.0.0, < 7.14.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-02T18:18:46.706Z"}, "descriptions": [{"lang": "en", "value": "React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.14.2."}], "source": {"advisory": "GHSA-49rj-9fvp-4h2h", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-03T14:01:21.166754Z", "id": "CVE-2026-42211", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-03T14:08:30.154Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42211", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-03T14:01:21.166754Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-03T14:01:45.125Z"}}], "cna": {"title": "React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE", "source": {"advisory": "GHSA-49rj-9fvp-4h2h", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "remix-run", "product": "react-router", "versions": [{"status": "affected", "version": ">= 7.0.0, < 7.14.2"}]}], "references": [{"url": "https://github.com/remix-run/react-router/security/advisories/GHSA-49rj-9fvp-4h2h", "name": "https://github.com/remix-run/react-router/security/advisories/GHSA-49rj-9fvp-4h2h", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.14.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-02T18:18:46.706Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42211", "state": "PUBLISHED", "dateUpdated": "2026-06-03T14:08:30.154Z", "dateReserved": "2026-04-25T05:04:37.028Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-02T18:18:46.706Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "react-router", "vendor": "remix-run", "versions": [{"status": "affected", "version": ">= 7.0.0, < 7.14.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "02931B5A-0559-41CC-8566-D6C018538F2C", "versionEndExcluding": "7.14.2", "versionStartIncluding": "7.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.14.2."}, {"lang": "es", "value": "React Router es un router para React. En las versiones 7.0.0 a 7.14.1, al usar el Framework Mode, una combinaci\u00f3n de pasos podr\u00eda potencialmente permitir la ejecuci\u00f3n remota de c\u00f3digo (RCE) no autorizada a trav\u00e9s de solicitudes externas. Este ataque requiere que el c\u00f3digo de la aplicaci\u00f3n tenga una vulnerabilidad de contaminaci\u00f3n de prototipos existente, la cual puede ser aprovechada en un ataque de 2 pasos donde el segundo paso desencadena RCE no autorizada en el servidor remoto. Esto no tiene impacto en aplicaciones que usan Declarative Mode (' BrowserRouter ') o Data Mode ('createBrowserRouter/ RouterProvider '). Esto est\u00e1 parcheado en la versi\u00f3n 7.14.2."}], "id": "CVE-2026-42211", "lastModified": "2026-07-21T19:10:00.107", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42211", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-03T14:01:21.166754Z", "version": "2.0.3"}}]}, "published": "2026-06-02T20:16:36.537", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/remix-run/react-router/security/advisories/GHSA-49rj-9fvp-4h2h"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.0.0,7.14.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "react-router", "source": "cna", "vendor": "remix-run"}, "product": "react-router", "vendor": "remix-run"}], "created": "2026-06-03T04:45:25.724226+00:00", "updated": "2026-06-03T10:55:18.810346+00:00", "vendors": ["remix-run", "remix-run$PRODUCT$react-router"]}