In short
- CVE-2026-33245 is a MEDIUM (CVSS 4.7) vulnerability affecting react-router (shopify), react-router.
- Chance of exploitation in the next 30 days (EPSS): 0.19%, higher than 8.5% of all vulnerabilities.
- Fix: update to 7.13.2 or later.
Description
When using React Router v7's unstable RSC APIs, there exists a potential client-side XSS issue in the RSC redirect handling if redirects are coming from untrusted sources
[!NOTE]
This only impacts your application if you are using the unstable RSC APIs in React Router.
NVD description
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.
More vulnerabilities in react-router
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free