Em resumo
- CVE-2026-33245 é uma vulnerabilidade MÉDIO (CVSS 4.7) que afeta react-router (shopify), react-router.
- Chance de exploração nos próximos 30 dias (EPSS): 0.19%, maior que 8.5% das vulnerabilidades.
- Correção: atualize para 7.13.2 ou posterior.
Description
When using React Router v7's unstable RSC APIs, there exists a potential client-side XSS issue in the RSC redirect handling if redirects are coming from untrusted sources
[!NOTE]
This only impacts your application if you are using the unstable RSC APIs in React Router.
NVD description
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free