En resumen
- CVE-2026-33245 es una vulnerabilidad MEDIO (CVSS 4.7) que afecta a react-router (shopify), react-router.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.19%, mayor que el 8.5% de las vulnerabilidades.
- Solución: actualizar a 7.13.2 o posterior.
Description
When using React Router v7's unstable RSC APIs, there exists a potential client-side XSS issue in the RSC redirect handling if redirects are coming from untrusted sources
[!NOTE]
This only impacts your application if you are using the unstable RSC APIs in React Router.
NVD description
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free