CVE-2026-21884

highpriority · track · 0EPSS 0.005 · 45 %ileDEEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.53% (45th) EPSS

CVSS 8.2 · high

Is it mine?

13 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · cert_bund · nvd

EPSS · scored 2026-10-27

React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. There is no impact if server-side rendering in Framework Mode is disabled, or if Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) is being used. This issue has been patched in @remix-run/react version 2.17.3 and react-router version 7.12.0.

cvss

Technical severity, 0–10. One row per scoring source.

8.2

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:Nsecondary · ENISA EU

v3.18.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:Nsecondary · security-advisories@github.comexploitability 2.8 · impact 4.7

v3.18.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:Nsecondaryexploitability 2.8 · impact 4.7

v3.18.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:Nsecondary · OSV

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79USCWE-79US

affected products (13)

Products and version ranges known to be affected.

IBM App Connect Enterpriseall versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:-
IBM SPSS <9.0.0.0 IF002all versionscert_bundDE
IBM Storage Scale <5.2.3.7all versionscert_bundDE
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
IBM SPSS< 9.0.0.0 IF002cert_bundDE
IBM Storage Scale< 5.2.3.7cert_bundDE
remix-run react-router@remix-run/react → 2.17.3enisa_euvdEU
remix-run react-routerreact-router 7.0.0, → 7.12.0enisa_euvdEU
shopify react-router7.0.0 → 7.11.0nvdUScpe:2.3:a:shopify:react-router:*:*:*:*:*:*:*:*
shopify remix-run/react< 2.17.3nvdUScpe:2.3:a:shopify:remix-run\/react:*:*:*:*:*:*:*:*
npm @remix-run/react< 2.17.3osvUSpkg:npm/%40remix-run/react
npm react-router7.0.0 → 7.12.0osvUSpkg:npm/react-router

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-0752IBM SPSS: Mehrere SchwachstellenDeutsch2026-03-16csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM SPSS ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, um einen Denial of Service Angriff durchzuführen, und um Dateien zu manipulieren.
GHSA-8v8x-cx79-35w7React Router SSR XSS in ScrollRestoration2026-01-08ghsa · osvUS
A XSS vulnerability exists in in React Router's `<ScrollRestoration>` API in [Framework Mode](https://reactrouter.com/start/modes#framework) when using the `getKey`/`storageKey` props during Server-Side Rendering which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the keys. > [!NOTE] > This does not impact applications if developers have [disabled server-side rendering](https://reactrouter.com/how-to/spa) in Framework Mode, or if they are using [Declarative Mode](https://reactrouter.com/start/modes#declarative) (`<BrowserRouter>`) or [Data Mode](https://reactrouter.com/start/modes#data) (`createBrowserRouter`/`<RouterProvider>`).

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund nvd osv NVD CVE.org MITRE

published 2026-01-10modified 2026-07-15

references (12)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan