CVE-2026-42211: React Router 7.0–7.14.1 Remote Code Execution via Prototype Pollution

Technical summary

CVE-2026-42211 is a remote code execution vulnerability in Shopify's React Router (versions 7.0.0–7.14.1) when deployed in Framework Mode. The vulnerability chain originates from a prototype pollution condition present in application code, which an attacker can manipulate through two coordinated external requests to achieve unauthorized RCE on the target server. The issue is rooted in improper deserialization or object manipulation (CWE-502) and does not affect applications using the BrowserRouter component or the RouterProvider-based Data Mode. Remediation requires upgrading to version 7.14.2 or later.

Business impact

Exploitation of this vulnerability could allow attackers to execute arbitrary code on affected web servers, potentially leading to data theft, service disruption, or lateral movement within infrastructure. The high CVSS score (8.1) reflects the severity of unauthorized code execution; however, real-world risk depends on whether deployed applications have a pre-existing prototype pollution flaw. Organizations running React Router in production should assess their routing implementation and any input validation gaps that could enable prototype pollution.

Affected systems

The vulnerability affects Shopify React Router versions 7.0.0 through 7.14.1 when used in Framework Mode. Applications using Declarative Mode (via `<BrowserRouter>`) or Data Mode (via `createBrowserRouter/<RouterProvider>`) are not affected. The attack vector is network-based with high complexity, as it requires an existing application vulnerability to be present before the React Router flaw can be exploited.

Exploitability

Exploitation requires two preconditions: (1) the application must contain a prototype pollution vulnerability, and (2) the application must use React Router's Framework Mode. While the attack vector is network-accessible and does not require authentication or user interaction, the high attack complexity (AC:H in the CVSS vector) reflects the dependency on a pre-existing flaw. No public exploit or CISA KEV listing currently exists, reducing immediate opportunistic attack risk, though organizations should assume sophisticated attackers may develop targeted payloads if prototype pollution flaws are known or discoverable.

Remediation

Upgrade React Router to version 7.14.2 or later. Organizations should simultaneously audit their application code for prototype pollution vulnerabilities—particularly in any user input handling, object merging, or deserialization logic—to eliminate the first stage of the attack chain. If Framework Mode usage is not required, migrating to Declarative or Data Mode eliminates exposure to this specific vulnerability.

Patch guidance

Apply the fix by updating the React Router dependency to version 7.14.2 or newer. Verify the update in package.json or package-lock.json, then rebuild and redeploy the application. Test routing functionality thoroughly in a staging environment before production rollout. Check the Shopify React Router release notes for any breaking changes or migration guidance between your current version and 7.14.2.

Detection guidance

Monitor for incoming requests that attempt to manipulate object prototypes or inject unexpected properties into serialized data passed to React Router. Log and alert on any Framework Mode request patterns that include unusual nested object structures or prototype-related payloads. Implement input validation and sanitization to block prototype pollution attempts. Review application logs for unexpected code execution or unusual process spawning that correlates with Framework Mode route handling. Use static analysis tools to identify prototype pollution vulnerabilities in the codebase before deployment.

Why prioritize this

This vulnerability scores HIGH (8.1 CVSS) due to the impact of remote code execution, though the required presence of a pre-existing prototype pollution flaw limits its attack surface. Organizations should prioritize patching if they (1) use React Router 7.0.0–7.14.1 in Framework Mode, (2) have not yet eliminated prototype pollution flaws in their codebase, or (3) handle untrusted external input. Patch quickly if these conditions apply; lower priority if using non-Framework routing modes or if prototype pollution vectors have been eliminated.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects a network-accessible vulnerability with high impact (confidentiality, integrity, and availability all compromised by code execution), no authentication required, and no user interaction needed. The score moderately penalizes attack complexity (AC:H) because successful exploitation depends on the presence of an application-level prototype pollution vulnerability, which is not guaranteed in all React Router deployments. The score does not account for the rarity of the chaining condition, making it a worst-case assessment.

Frequently asked questions