Critical React Router Flaws: CVE-2025-61686 Exposes Server Files

This report details multiple security vulnerabilities in react-router and @remix-run packages—most notably CVE-2025-61686 (CVSS 9.1) in createFileSessionStorage that can allow session-based reads/writes outside the intended directory, several high-severity XSS issues (including Meta Component XSS, ScrollRestoration XSS, and an SPA open-redirect XSS), and additional CSRF and external redirect logic flaws; maintainers have released patches and users should verify and update affected versions immediately.