جزئیات آسیب‌پذیری
CVE-2026-22029
Red Hat Logging Subsystem for Red Hat OpenShiftRed Hat Migration Toolkit for VirtualizationRed Hat Multicluster Engine for KubernetesRed Hat OpenShift LightspeedRed Hat OpenShift PipelinesRed Hat Advanced Cluster Management for Kubernetes 2
React Router vulnerable to XSS via Open Redirects
CVSS 3.1
8.0بالا
شرح رسمی (انگلیسی)
React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (<BrowserRouter>) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 8.0بالا | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N |
| 8.0بالا | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Red Hat | Logging Subsystem for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Migration Toolkit for Virtualization | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Migration Toolkit for Virtualization | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Multicluster Engine for Kubernetes | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Lightspeed | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Lightspeed | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Connectivity Link 1 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Data Grid 8 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Developer Hub | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Edge Manager preview | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Edge Manager preview | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Edge Manager preview | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Edge Manager preview | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Edge Manager preview | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Edge Manager preview | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Edge Manager preview | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Edge Manager preview | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Edge Manager preview | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Edge Manager preview | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Edge Manager preview | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Edge Manager preview | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Edge Manager preview | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Fuse 7 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift GitOps | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift GitOps | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift GitOps | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift GitOps | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Virtualization 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Virtualization 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift distributed tracing 3 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Process Automation 7 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Quay 3 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Quay 3 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Single Sign-On 7 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apicurio Registry 2 | همه | CVEProject cvelistV5 (CNA) |
| remix-run | @remix-run/router | < 1.23.2 | CVEProject cvelistV5 (CNA) |
| remix-run | react-router | >= 7.0.0, < 7.12.0 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۴۲- https://github.com/remix-run/react-router/security/advisories/GHSA-2w69-qvjg-hvjx x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2026-22029 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2428412 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22029.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:3959 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3958 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41064 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5633 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8229 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36882 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2572 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13548 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1517 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2350 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2568 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3960 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2694 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36651 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40945 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40118 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41928 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3782 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19712 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34100 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21658 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:20042 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:20041 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17469 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17468 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17474 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2456 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2147 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2148 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2149 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26420 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26413 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40984 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3087 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13542 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:9848 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5636 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8218 vendor-advisoryx_refsource_REDHAT
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۴/۱۰/۲۰
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۶/۱۹
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- GitHub_M
پیش‌بینی بهره‌برداری (EPSS)
۰٫۸۶٪
احتمال بهره‌برداری در ۳۰ روز
۵۸٫۸٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهره‌برداری
- ندارد
- اثر فنی
- کامل
ضعف‌ها (CWE)
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')