CVE-2026-22029: 
JavaScript vulnerability analysis and mitigation

CVE-2026-22029 is a Cross-Site Scripting (XSS) vulnerability in React Router and Remix v1/v2 caused by unsafe handling of open navigation redirects. When loaders or actions in Framework Mode, Data Mode, or unstable RSC modes generate redirect paths from untrusted content, the resulting URLs can trigger unintended JavaScript execution in the client browser. Affected packages are @remix-run/router versions ≤ 1.23.1 and react-router versions 7.0.0 through 7.11.0. The vulnerability was published on January 8, 2026, with NVD publication on January 10, 2026. The GitHub Security Advisory assigns a CVSS v3.1 score of 8.0 (High), while NVD records a score of 6.1 (Medium) (Github Advisory, React Router Advisory).

The root cause is improper neutralization of user-controllable input during web page generation (CWE-79). In non-Declarative Mode configurations (Framework Mode, Data Mode, or unstable RSC modes), React Router's SPA navigation processes redirect URLs returned by loaders or actions without adequately sanitizing them. If redirect destinations are constructed from attacker-controlled or untrusted content — for example, via an open redirect pattern — the framework can navigate the browser to a javascript: URI or similarly unsafe URL scheme, causing arbitrary JavaScript to execute in the user's browser context. Applications using Declarative Mode (<BrowserRouter>) are not affected, as this code path is not exercised (Github Advisory, React Router Advisory).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the victim's browser with the privileges of the authenticated user, enabling session hijacking, credential theft, unauthorized actions on behalf of the user, and exfiltration of sensitive data accessible to the session. The scope change (S:C in CVSS) reflects that the injected script can affect resources beyond the vulnerable component itself. Availability is not directly impacted, but confidentiality and integrity of user data and sessions are at risk (Github Advisory, Feedly).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Github Advisory). The EPSS score is approximately 0.041% (0.000410), placing it in the 1st percentile for exploitation likelihood within 30 days. No threat actor attribution has been identified, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a victim must click a crafted link — and the attacker must be able to influence redirect paths in a vulnerable application (Github Advisory).

1. Identify a vulnerable target: Find a web application using react-router 7.0.0–7.11.0 or @remix-run/router ≤ 1.23.1 in Framework Mode, Data Mode, or unstable RSC mode (not Declarative/BrowserRouter mode).
2. Locate an open redirect or untrusted redirect path: Identify a loader or action in the application that constructs a redirect URL using user-supplied or externally controlled input (e.g., a ?redirect= query parameter passed to a loader).
3. Craft a malicious redirect URL: Construct a payload such as javascript:alert(document.cookie) or a more sophisticated payload to steal session tokens or perform actions on behalf of the user.
4. Deliver the malicious link: Send the crafted URL to a victim user via phishing, social engineering, or by embedding it in content the user is likely to click.
5. Trigger JavaScript execution: When the victim clicks the link and the application's loader/action processes the redirect, React Router navigates to the unsafe URL, executing the attacker's JavaScript in the victim's browser context with the user's session privileges (Github Advisory, React Router Advisory).

• Network: Outbound requests from the victim's browser to attacker-controlled infrastructure (e.g., for cookie exfiltration) following navigation to a page using React Router in non-Declarative Mode.
• Logs: Web server or CDN access logs showing requests with query parameters containing javascript: URI schemes or encoded variants (e.g., %6a%61%76%61%73%63%72%69%70%74%3a) in redirect-related parameters.
• Browser/Client: Browser console errors or unexpected JavaScript execution events on pages that perform SPA navigation; unexpected javascript: URIs appearing in browser history or navigation events.
• Application Logs: Loader or action logs showing redirect destinations containing javascript:, data:, or other non-HTTP URI schemes originating from user-supplied input.

The primary remediation is to upgrade @remix-run/router to version 1.23.2 or later, and react-router to version 7.12.0 or later (Github Advisory). Applications using Declarative Mode (<BrowserRouter>) are not affected and require no action. As a workaround, developers should validate and sanitize all redirect destinations in loaders and actions to ensure they only accept trusted, relative, or allowlisted URLs — never user-supplied arbitrary strings. Implementing a Content Security Policy (CSP) that restricts script-src can reduce the impact of any successful XSS. Red Hat has addressed this in Ansible Automation Platform via RHSA-2026:3958 and RHSA-2026:3959, and multiple IBM products have received patches as well (Red Hat Bugzilla, IBM Advisory).

The vulnerability was reported by security researcher "Oceandust" and published by the React Router maintainer brophdawg11 on January 8, 2026 (Github Advisory). The Belgian Centre for Cybersecurity (CCB) issued a warning advising immediate patching for high-severity React Router vulnerabilities. Multiple downstream vendors including IBM and Red Hat issued security bulletins addressing the issue across a wide range of products. Community discussion on Mastodon and Bluesky noted the vulnerability's scope, with coverage from outlets such as The Hacker Wire and Security Online.