Remix-run/react vulnerabilities

2 known vulnerabilities in Remix-run/react from Shopify. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.2 High severity

  react-router: Improper Neutralization of Input During Web Page Generation

  CVE-2026-21884Jan 10, 2026Remix-run

  React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Serv

• 7.6 High severity

  react-router: Improper Neutralization of Input During Web Page Generation

  CVE-2025-59057Jan 10, 2026Remix-run

  React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags whic