{"id":"CVE-2026-33245","aliases":["CLSA-2026-1792192714","CLSA-2026-1792253403","EUVD-2026-33988","GHSA-8646-j5j9-6r62","ROOT-APP-NPM-CVE-2026-33245","openSUSE-SU-2026:11680-1"],"status":"published","title":"React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets","description":"React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00189,"percentile":0.08558,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-06-02T17:14:50Z","modified":"2026-10-28T02:30:31Z","fixes":[{"ecosystem":"npm","package":"react-router","fixed_in":["7.13.2"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"react-router","fixed_in":["7.12.0-aikido.2","7.12.0-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/react-router","fixed_in":["7.12.0-root.io.2","7.12.0-root.io.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.7.0"},{"fixed":"7.13.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.13.1-tuxcare.0"},{"fixed":"7.13.1-tuxcare.1"}]}],"versions":["7.13.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.13.1-tuxcare.0"},{"fixed":"7.13.1-tuxcare.1"}]}],"versions":["7.13.1"],"bundled":3},{"source":"osv","ecosystem":"npm","package":"react-router","ranges":[{"type":"SEMVER","events":[{"introduced":"7.7.0"},{"fixed":"7.13.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.12.0-aikido.2"},{"fixed":"7.12.0-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.12.0-root.io.2"},{"fixed":"7.12.0-root.io.3"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"agama-web-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24+0.a836cced5-52.1"}]}],"bundled":19}],"products":[{"vendor":"@tanstack","product":"react-router"},{"vendor":"remix-run","product":"react-router"},{"vendor":"shopify","product":"react-router"}],"references":[{"url":"https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33245","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8646-j5j9-6r62"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33245.json","tags":["advisory"]},{"url":"https://github.com/remix-run/react-router","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73650","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-33245","title":"React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets","description":"React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.","status":"published","published":"2026-06-02T17:14:50.377Z","modified":"2026-06-03T19:09:34.483Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:20:08.009733Z"}],"euvd":[{"id":"EUVD-2026-33988","description":"React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.","status":"published","published":"2026-06-02T17:14:50Z","modified":"2026-06-03T19:09:34Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:20:53.780241Z"}],"ghsa":[{"id":"GHSA-8646-j5j9-6r62","title":"React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets","description":"When using React Router v7's unstable RSC APIs, there exists a potential client-side XSS issue in the RSC redirect handling if redirects are coming from untrusted sources\n\n\u003e [!NOTE]\n\u003e This only impacts your application if you are using the unstable RSC APIs in React Router.","status":"published","published":"2026-06-03T20:33:32Z","modified":"2026-06-03T20:33:33Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:40:16.698699Z"}],"nvd":[{"id":"CVE-2026-33245","description":"React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.","status":"published","published":"2026-06-02T20:16:34.367Z","modified":"2026-07-22T19:10:00.12Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:22.022466Z"}],"osv":[{"id":"CVE-2026-33245","title":"React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets","description":"React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.","status":"published","published":"2026-06-02T17:14:50.377Z","modified":"2026-10-28T02:30:31.48994916Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:45:01.548715Z"},{"id":"GHSA-8646-j5j9-6r62","title":"React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets","description":"When using React Router v7's unstable RSC APIs, there exists a potential client-side XSS issue in the RSC redirect handling if redirects are coming from untrusted sources\n\n\u003e [!NOTE]\n\u003e This only impacts your application if you are using the unstable RSC APIs in React Router.","status":"published","published":"2026-06-03T20:33:32Z","modified":"2026-06-03T20:56:27.775998Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:41.732368Z"},{"id":"CLSA-2026-1792192714","title":"TuxCare security update for react-router (3 CVEs)","description":"TuxCare rebuilt react-router to address 3 CVEs. Fixed in 7.13.1-tuxcare.1.","status":"published","published":"2026-10-16T23:18:34Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792253403","title":"TuxCare security update for react-router-dom (3 CVEs)","description":"TuxCare rebuilt react-router-dom to address 3 CVEs. Fixed in 7.13.1-tuxcare.1.","status":"published","published":"2026-10-17T16:09:59Z","modified":"2026-10-17T19:01:35.064087013Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"openSUSE-SU-2026:11680-1","title":"agama-web-ui-24+0.a836cced5-52.1 on GA media","description":"These are all security issues fixed in the agama-web-ui-24+0.a836cced5-52.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-04T00:00:00Z","modified":"2026-09-05T09:45:03.960220408Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"ROOT-APP-NPM-CVE-2026-33245","title":"CVE-2026-33245 in react-router - Patched by Root","description":"Root has patched CVE-2026-33245 in the react-router package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-04T12:12:16Z","modified":"2026-08-04T19:30:19.517819725Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}