React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

中危 4.7CVE-2026-33245 · GHSA-8646-j5j9-6r62 · Published 02/06/2026 · updated 22/07/2026

要点

CVE-2026-33245 是影响 react-router (shopify), react-router 的中危 (CVSS 4.7)漏洞。
未来 30 天内被利用的概率（EPSS）：0.19%，高于 8.5% 的漏洞。
修复：升级到 7.13.2 或更高版本。

Package	Affected versions	Patched versions
react-router shopify	`≥ 7.7.0, < 7.13.2`	`7.13.2`
react-router npm	`≥ 7.7.0, < 7.13.2`	`7.13.2`

Description

When using React Router v7's unstable RSC APIs, there exists a potential client-side XSS issue in the RSC redirect handling if redirects are coming from untrusted sources

[!NOTE] This only impacts your application if you are using the unstable RSC APIs in React Router.

NVD description

React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.

References

remix-run/react-router security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-33245 · ADVISORY
remix-run/react-router · PACKAGE

react-router 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

react-router

shopify

≥ 7.7.0, < 7.13.2

7.13.2

react-router

npm

≥ 7.7.0, < 7.13.2

7.13.2

Description

When using React Router v7's unstable RSC APIs, there exists a potential client-side XSS issue in the RSC redirect handling if redirects are coming from untrusted sources

[!NOTE] This only impacts your application if you are using the unstable RSC APIs in React Router.

NVD description

react-router 的其他漏洞

查看全部 →