[GHSA-qwww-vcr4-c8h2] React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response - #8954
Conversation
|
Hi there @brophdawg11! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
|
Duplicate of #8936 |
There was a problem hiding this comment.
Pull request overview
Updates React Router advisory GHSA-qwww-vcr4-c8h2 to represent patched v7 and v8 release lines.
Changes:
- Splits affected versions into two ranges.
- Adds last-known affected version metadata.
Suppressed comments (1)
advisories/github-reviewed/2026/07/GHSA-qwww-vcr4-c8h2/GHSA-qwww-vcr4-c8h2.json:51
- As with the v7 range, an OSV
fixedevent requires an exact version rather than a comparator. Keeping>= 8.3.0makes the event an invalid npm version; use8.3.0.
"fixed": ">= 8.3.0"
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "type": "ECOSYSTEM", | ||
| "events": [ | ||
| { | ||
| "introduced": "7.12.0" |
| }, | ||
| { | ||
| "fixed": "8.3.0" | ||
| "fixed": ">= 7.18.2" |
Updates
Comments
GHSA-qwww-vcr4-c8h2