VDB
CVE-2026-33245
CVE-2026-33245
PUBLISHED
CVSS 8 HIGH
Reported by GitHub_M · Published June 2, 2026
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.
Risk Scores
CVSS 3.1
8
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| remix-run | react-router | >= 7.7.0, < 7.13.2 |
| npm | react-router | 7.7.0 |
| remix-run | react-router | >= 7.7.0, < 7.13.2, >= 7.7.0, < 7.13.2, >= 7.7.0, < 7.13.2 |
Timeline
- Jun 2, 2026 CVE Published
- Jun 3, 2026 CVE Updated
- Jun 5, 2026 EPSS Score
- Jun 5, 2026 Security Advisory
- Jun 10, 2026 Coalition ESS Score
- Jul 20, 2026 Distribution Patch
- Jul 20, 2026 Security Advisory
- Aug 7, 2026 EPSS Score
- Aug 24, 2026 EPSS Score
- Sep 9, 2026 EPSS Score
- Sep 16, 2026 EPSS Score