CVE-2026-42211Shopify React-router Deserialization of Untrusted Data
NVDCVSS scored by security-advisories@github.com
Vulnerability Summary
React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.14.2.
CVSS v3.1 Base Metrics — Score 8.1 (HIGH)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HAttack VectorNetwork
Attack ComplexityHigh
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected & Patched Versions
- Shopify React-router >= 7.0.0 and < 7.14.2
- Shopify React-router 7.14.2
What to do
Plan remediation soon. No exploitation is confirmed yet, but the severity is high.
- Check whether you run Shopify React-router and which version.
- Update to a patched version listed above, then confirm the new version.
Timeline
- Jun 2, 2026Published
- Jul 21, 2026Record last modified
Score, severity and exploitation changes are tracked from the day Watchtower started logging them.
Get notified about new Shopify React-router CVEsYou are reading CVE-2026-42211. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alertsRelated Coverage
External References
Data last checked: Nov 15, 2026 03:31 UTC