React Router is a router for React. In @remix-run/router version prior to 1.23.2. and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open…

React Router versions prior to 1.23.2 and react-router 7.0.0 through 7.11.0 contain an open redirect vulnerability in SPA navigation. The vulnerability affects Framework Mode, Data Mode, and unstable RSC modes, allowing unsafe URLs to cause unintended JavaScript execution on the client. The issue only occurs when creating redirect paths from untrusted content or via open redirects. Declarative Mode using BrowserRouter is not affected. Patches are available in @remix-run/router version 1.23.2 and react-router version 7.12.0.