GHSA-8646-j5j9-6r62

ghsaUSosv

React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

view advisory published 2026-06-03Licence: CC-BY-4.0

When using React Router v7's unstable RSC APIs, there exists a potential client-side XSS issue in the RSC redirect handling if redirects are coming from untrusted sources > [!NOTE] > This only impacts your application if you are using the unstable RSC APIs in React Router.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-33245US	medium4.7	0.19% (8th)	—	2026-06-02
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-…

references

External citations — patches, advisories, analysis.

https://github.com/remix-run/react-routerPACKAGE
https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62WEB
https://nvd.nist.gov/vuln/detail/CVE-2026-33245ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan