Bug 2502736

Summary: CVE-2026-42211 fbthrift: React Router: Remote Code Execution via prototype pollution in Framework Mode [epel-all]
Product: [Fedora] Fedora EPEL Reporter: Hardik Vyas <hvyas>
Component: fbthriftAssignee: Michel Lind <michel>
Status: CLOSED NOTABUG QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: epel10CC: michel
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["70620414-f555-42bb-b96b-88580bdc33ab"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-08-04 17:25:08 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2443016, 2484115    

Description Hardik Vyas 2026-07-20 11:09:00 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized RCE on the remote server. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.14.2.
Comment 1 Michel Lind 2026-08-04 17:25:08 UTC 
This CVE is in a JavaScript/NodeJS package; the JavaScript here is not shipped in the binary RPMs.