CVE-2025-61686

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 9.1EPSS 18%

Published 2026-01-10Updated 2026-01-15

Media 1759PoC

Vulnerability details

React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage() is being used from @react-router/node (or @remix-run/node/@remix-run/deno in Remix v2) with an unsigned cookie, it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would depend on the permissions of the web server process to access those files. Read files cannot be returned directly to the attacker. Session file reads would only succeed if the file matched the expected session file format. If the file matched the session file format, the data would be populated into the server side session but not directly returned to the attacker unless the application logic returned specific session information. This issue has been patched in @react-router/node version 7.9.4, @remix-run/deno version 2.17.2, and @remix-run/node version 2.17.2.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CNAGitHub_M

EPSS score history

Sources

5 links

PoC links are not available for guest users. Login to view them.

CVEShield CVE Organization The Hacker News RedHat Vuln DB NVD Analysis

Profile

CVSS

9.1

EPSS

18%

Published

2026-01-10

Updated

2026-01-15

CNA

GitHub_M

Vendors

remix-run

1 product

CPEs

cpe:/a:redhat:cryostat:4

cpe:/a:redhat:gatekeeper:3

cpe:/a:redhat:logging:5

cpe:/a:redhat:migration_toolkit_applications:7

cpe:/a:redhat:migration_toolkit_applications:8

cpe:/a:redhat:rhmt:1

cpe:/a:redhat:migration_toolkit_virtualization:2

cpe:/a:redhat:multicluster_engine

cpe:/a:redhat:network_observ_optr:1

cpe:/a:redhat:workload_availability_nhc:0

cpe:/a:redhat:openshift_lightspeed

cpe:/a:redhat:openshift_pipelines:1

cpe:/a:redhat:service_mesh:2

cpe:/a:redhat:service_mesh:3

cpe:/a:redhat:acm:2

cpe:/a:redhat:advanced_cluster_security:4

cpe:/a:redhat:ansible_automation_platform:2

cpe:/a:redhat:apache_camel_hawtio:4

cpe:/a:redhat:service_registry:2

cpe:/a:redhat:kueue_operator:1

cpe:/a:redhat:optaplanner:::el6

cpe:/a:redhat:connectivity_link:1

cpe:/a:redhat:jboss_data_grid:8

cpe:/a:redhat:rhdh:1

cpe:/a:redhat:discovery:2::el9

cpe:/a:redhat:edge_manager:1

cpe:/a:redhat:edge_manager:0

cpe:/o:redhat:enterprise_linux:10

cpe:/o:redhat:enterprise_linux:8

cpe:/o:redhat:enterprise_linux:9

cpe:/a:redhat:jboss_fuse:7

cpe:/a:redhat:jboss_enterprise_application_platform:8

cpe:/a:redhat:jbosseapxp

cpe:/a:redhat:openshift_ai

cpe:/a:redhat:openshift:4

cpe:/a:redhat:openshift_data_foundation:4

cpe:/a:redhat:openshift_devspaces:3

cpe:/a:redhat:openshift_distributed_tracing:3

cpe:/a:redhat:openshift_gitops:1

cpe:/a:redhat:container_native_virtualization:4

cpe:/a:redhat:jboss_enterprise_bpms_platform:7

cpe:/a:redhat:quay:3

cpe:/a:redhat:satellite:6

cpe:/a:redhat:red_hat_single_sign_on:7

cpe:/a:redhat:trusted_artifact_signer:1

cpe:/a:redhat:trusted_profile_analyzer:2

cpe:/a:redhat:logging:6

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated