Bug 2502734

Summary:	CVE-2026-42211 llama-cpp: React Router: Remote Code Execution via prototype pollution in Framework Mode [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Hardik Vyas <hvyas>
Component:	llama-cpp	Assignee:	Tom.Rix
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	45	CC:	Man2Dev, rocm-packagers-sig, Tom.Rix
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["70620414-f555-42bb-b96b-88580bdc33ab"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2484115

Description Hardik Vyas 2026-07-20 11:08:51 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.14.2.

Comment 1 Aoife Moloney 2026-08-17 15:22:44 UTC

This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.