CVE-2026-33245
React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.
- Record
CVE-2026-33245- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-33988
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.
- Record
EUVD-2026-33988- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8646-j5j9-6r62
React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
When using React Router v7's unstable RSC APIs, there exists a potential client-side XSS issue in the RSC redirect handling if redirects are coming from untrusted sources
[!NOTE] This only impacts your application if you are using the unstable RSC APIs in React Router.
- Record
GHSA-8646-j5j9-6r62- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.
- Record
CVE-2026-33245- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N - CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.
- Record
CVE-2026-33245- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-8646-j5j9-6r62
React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
When using React Router v7's unstable RSC APIs, there exists a potential client-side XSS issue in the RSC redirect handling if redirects are coming from untrusted sources
[!NOTE] This only impacts your application if you are using the unstable RSC APIs in React Router.
- Record
GHSA-8646-j5j9-6r62- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Show 4 moreShow less
OSVCLSA-2026-1792192714 No score
TuxCare security update for react-router (3 CVEs)
TuxCare rebuilt react-router to address 3 CVEs. Fixed in 7.13.1-tuxcare.1.
- Record
CLSA-2026-1792192714- Updated
- 2026-11-02
OSVCLSA-2026-1792253403 No score
TuxCare security update for react-router-dom (3 CVEs)
TuxCare rebuilt react-router-dom to address 3 CVEs. Fixed in 7.13.1-tuxcare.1.
- Record
CLSA-2026-1792253403- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11680-1 No score
agama-web-ui-24+0.a836cced5-52.1 on GA media
These are all security issues fixed in the agama-web-ui-24+0.a836cced5-52.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11680-1- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-33245 No score
CVE-2026-33245 in react-router - Patched by Root
Root has patched CVE-2026-33245 in the react-router package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-33245- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
react-routernpm |
7.7.0 up to 7.13.2 | 7.13.2 |
react-routerTuxCare:npm From an advisory covering 3 CVEs |
7.13.1-tuxcare.0 up to 7.13.1-tuxcare.1, plus listed versions 7.13.1 |
7.13.1-tuxcare.1 |
react-router-domTuxCare:npm From an advisory covering 3 CVEs |
7.13.1-tuxcare.0 up to 7.13.1-tuxcare.1, plus listed versions 7.13.1 |
7.13.1-tuxcare.1 |
react-routerRoot:npm |
before 7.12.0-aikido.2 | 7.12.0-aikido.27.12.0-aikido.3 |
@rootio/react-routerRoot:npm |
before 7.12.0-root.io.2 | 7.12.0-root.io.27.12.0-root.io.3 |
agama-web-uiopenSUSE:Tumbleweed From an advisory covering 19 CVEs |
before 24+0.a836cced5-52.1 | 24+0.a836cced5-52.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-33245 is a high vulnerability (CVSS 8.0) in @tanstack React-router, published June 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in react-router 7.13.2.
References
github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62
nvd.nist.gov/vuln/detail/CVE-2026-33245
suse.com/security/cve/CVE-2025-7783
Show 18 moreShow less