Post

We just published 6 CVEs identifying security vulnerabilities in React Router and Remix v2 We recommend updating to the latest appropriate versions: React Router v7 -- 7.12.0 React Router v6 -- 6.30.3 Remix v2 -- 2.17.2 Details, links, and package ranges are listed below

XSS via Meta component when generating script:ld+json tags github.com/remix-run/re... Framework Mode only Affected versions: - @​remix-run/react >=1.15.0, <=2.17.0 - react-router >=7.0.0, <=7.8.2

Unauthorized file access when using `createFileSessionStorage()` with unsigned cookies github.com/remix-run/re... Framework Mode Only Affected versions: - @​react-router/node >= 7.0.0, <=7.9.3 - @​remix-run/deno <=2.17.1 - @​remix-run/node <=2.17.1

Unexpected external redirect via untrusted paths github.com/remix-run/re... Affected versions: - react-router >=6.0.0,<=6.30.1 - react-router >=7.0.0,<=7.9.5

XSS via Open Redirects github.com/remix-run/re... Framework/Data mode only Affected versions: - @​remix-run/router <=1.23.1 - react-router >=7.0.0,<=7.11.0