[GHSA-8v8x-cx79-35w7] React Router SSR XSS in ScrollRestoration

[HF-CYGG]

Updates

• References

Comments
Add the missing upstream React Router v7 fix commit for GHSA-8v8x-cx79-35w7.

Commit c89c32c562a7723c45ee71dab1c892acaf7a608d is the merged commit for upstream PR #14705. In ScrollRestoration, it applies escapeHtml() to both JSON.stringify(storageKey || SCROLL_RESTORATION_STORAGE_KEY) and JSON.stringify(ssrKey) before embedding them in the inline script through dangerouslySetInnerHTML. This directly matches the advisory's SSR XSS condition involving untrusted getKey/storageKey values.

The commit's changeset identifies this as a react-router patch. The 7.12.0 changelog lists PR #14705, and the release tag contains this commit, matching the patched React Router version already recorded by the advisory.

Supporting sources:

• Upstream PR: Escape HTML in scroll restoration keys remix-run/react-router#14705
• Release changelog: https://github.com/remix-run/react-router/blob/react-router%407.12.0/CHANGELOG.md#v7120
• Release ancestry: remix-run/react-router@c89c32c...react-router@7.12.0

The proposed advisory change only adds the fix commit reference. No changes to package ranges, patched versions, severity, CWE, or the advisory description are proposed.

[github]

Hi there @brophdawg11! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory