shopify

React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation

React Router vulnerable to Denial of Service via reflected user input in single-fetch

React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

React Router has stored XSS via unescaped Location header in prerendered redirect HTML

Tophat has a Command Injection Vulnerability When Accessing a Maliciously Crafted Tophat Link

Ruby LSP has arbitrary code execution through branch setting

React Router has CSRF issue in Action/Server Action Request Processing

React Router vulnerable to XSS via Open Redirects