High · published January 10, 2026
⚡ Watch out! React Router versions 7.0.0 through 7.11.0 and @remix-run/router versions prior to 1.23.2 can allow sneaky open redirects from untrusted sources — like leaving the backdoor open in your digital dream house! 💻 Think of React Router as a delivery service. If the courier takes a poorly labeled package (a redirect from bad content) and delivers it to an unexpected address, it could lead to chaos — like someone opening the door to a surprise that you never wanted! 📦 An attacker could exploit this vulnerability to redirect users to unsafe URLs, which might execute unintended JavaScript on their devices. Imagine opening a door and finding a digital gremlin ready to wreak havoc — absolutely devastating for user security!
Think of React Router as a delivery service. If the courier takes a poorly labeled package (a redirect from bad content) and delivers it to an unexpected address, it could lead to chaos — like someone opening the door to a surprise that you never wanted! 📦 This vulnerability in React Router allows unsafe open redirects originating from loaders or actions, leading to the execution of malicious scripts if untrusted content is involved. It particularly affects versions 7.0.0 through 7.11.0 and @remix-run/router prior to 1.23.2.
An attacker could exploit this vulnerability to redirect users to unsafe URLs, which might execute unintended JavaScript on their devices. Imagine opening a door and finding a digital gremlin ready to wreak havoc — absolutely devastating for user security! To mitigate this risk, upgrade to React Router version 7.12.0 or @remix-run/router version 1.23.2. Additionally, avoid creating redirect paths from untrusted content to ensure user safety! 🛡️ You've got this! Patch those versions and keep your application secure! 🚀
| Product | Versions | Fixed in |
|---|---|---|
| shopify/remix-run\/react | < 1.23.2 | 1.23.2 |
| shopify/react-router | ≥ 7.0.0, ≤ 7.11.0 | — |