En bref
- CVE-2026-33245 est une vulnérabilité MOYENNE (CVSS 4.7) touchant react-router (shopify), react-router.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.19%, plus élevée que 8.5% des vulnérabilités.
- Correctif : mettre à jour vers 7.13.2 ou plus récent.
Description
When using React Router v7's unstable RSC APIs, there exists a potential client-side XSS issue in the RSC redirect handling if redirects are coming from untrusted sources
[!NOTE]
This only impacts your application if you are using the unstable RSC APIs in React Router.
NVD description
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free