Description

A flaw was found in React Router. If an application is configured to allow attacker-supplied input to modify errors during server-side rendering (SSR), a remote attacker could trigger unexpected code execution on the client. This execution could lead to an outbound network request, potentially resulting in limited information disclosure or unintended network activity. This vulnerability specifically affects applications utilizing Framework Mode and Data Mode with manual SSR/hydration.

Mitigation

Aliases

References