High · published January 10, 2026
⚡ A sneaky XSS vulnerability lurks in React Router's <ScrollRestoration> API for versions up to 7.11.0! 🤯 If you're using the wrong keys during Server-Side Rendering (SSR), attackers could run arbitrary JavaScript! Think of your website like a restaurant where the menu is printed with ingredients. If someone slips in a special ingredient (untrusted content) that wasn’t vetted, they could end up serving a dish that’s not just unappetizing but downright dangerous! 🍽️ An attacker could exploit this vulnerability to execute malicious JavaScript during the SSR process, potentially gaining access to sensitive data or hijacking user sessions. This could lead to devastating consequences for users, such as stolen credentials or compromised accounts.
Think of your website like a restaurant where the menu is printed with ingredients. If someone slips in a special ingredient (untrusted content) that wasn’t vetted, they could end up serving a dish that’s not just unappetizing but downright dangerous! 🍽️ This XSS vulnerability exists in @remix-run/react prior to version 2.17.3 and react-router versions 7.0.0 through 7.11.0, specifically in the <ScrollRestoration> API when the getKey/storageKey props are incorrectly used with untrusted input during Server-Side Rendering.
An attacker could exploit this vulnerability to execute malicious JavaScript during the SSR process, potentially gaining access to sensitive data or hijacking user sessions. This could lead to devastating consequences for users, such as stolen credentials or compromised accounts. To safeguard your application, upgrade to @remix-run/react version 2.17.3 or react-router version 7.12.0 immediately. Additionally, review your implementation of the <ScrollRestoration> API to ensure that only trusted content is used for keys. 🛡️ You've got this! Follow these steps, and you’ll have your site secured in no time. 🚀