[GHSA-qwww-vcr4-c8h2] React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

[jochenschmich-aeberle]

Updates

• Affected products

Comments
The fix has been backported to the v7 branch of react-router and implemented with version 7.18.2.
See updated details at GHSA-qwww-vcr4-c8h2

[github]

Hi there @brophdawg11! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Pull request overview

Updates the React Router advisory to include the v7.18.2 backported fix.

Changes:

• Changes the v7 fixed-version boundary.
• Adds v7 and v8 affected-version records.

Suppressed comments (1)

advisories/github-reviewed/2026/07/GHSA-qwww-vcr4-c8h2/GHSA-qwww-vcr4-c8h2.json:86

• This second version-8 entry starts react-router at 0 and ends at 8.3.0, which subsumes the other ranges and incorrectly reports all pre-7.12.0 versions as vulnerable. Remove this duplicate affected entry, or correct the package/range if it represents another product.

              "introduced": "0"

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jochenschmich-aeberle]

@copilot Should be fixed by now, please confirm.

[jochenschmich-aeberle]

Already requested in numerous other PRs.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Suppressed comments (3)

advisories/github-reviewed/2026/07/GHSA-qwww-vcr4-c8h2/GHSA-qwww-vcr4-c8h2.json:48

• This duplicate react-router range still starts at version 0, so it marks every release before 7.18.2 as affected and contradicts the 7.12.0 introduction immediately above. Remove this affected entry, or change its package/range if it was intended to represent another affected product.

              "introduced": "0"
            },
            {
              "fixed": ">= 7.18.2"

advisories/github-reviewed/2026/07/GHSA-qwww-vcr4-c8h2/GHSA-qwww-vcr4-c8h2.json:70

• An OSV fixed event must contain the exact boundary version rather than a comparator expression. Replace this with 8.3.0 so ecosystem-version parsers can interpret the event.

              "fixed": ">= 8.3.0"

advisories/github-reviewed/2026/07/GHSA-qwww-vcr4-c8h2/GHSA-qwww-vcr4-c8h2.json:89

• Starting this second duplicate range at 0 nullifies the newly recorded 7.18.2 fix: it marks 7.18.2 and every later v7 release as affected until 8.3.0. Remove this affected entry, or correct the package/range if it was meant to describe a different product.

              "introduced": "0"
            },
            {
              "fixed": ">= 8.3.0"