Code Injection in Remix and React Router - CVE-2026-21884
Published: March 18, 2026 / Updated: March 19, 2026
Vulnerability identifier: #VU124088
CSH Severity: High
CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-21884
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation within API in Framework Mode when using the getKey/storageKey props during server-side rendering. A remote attacker can pass specially crafted request and execute arbitrary JavaScript code during SSR if untrusted content is used to generate the keys.
Successful exploitation of this vulnerability requires that server-side rendering in Framework Mode is enabled.
Affected software
Remix
React Router
IBM Fusion HCI
Crowd Data Center
Ansible Automation Platform
Data Cataloging
python3.12-pillow-debugsource (Red Hat package)
React Router
IBM Fusion HCI
Crowd Data Center
Ansible Automation Platform
Data Cataloging
python3.12-pillow-debugsource (Red Hat package)
How to mitigate CVE-2026-21884
Install updates from vendor's website.
Remix - update to 2.17.3
React Router - update to 7.12.0
IBM Fusion HCI - update to 2.13.0
Crowd Data Center - update to 7.1.5
Data Cataloging - update to 2.5.3
Ansible Automation Platform - update to 2.6
python3.12-pillow-debugsource (Red Hat package) - update to 10.3.0-2.el9ap
React Router - update to 7.12.0
IBM Fusion HCI - update to 2.13.0
Crowd Data Center - update to 7.1.5
Data Cataloging - update to 2.5.3
Ansible Automation Platform - update to 2.6
python3.12-pillow-debugsource (Red Hat package) - update to 10.3.0-2.el9ap