Vulnerability · Published Jun 2, 2026 · Assigned by GitHub_M
CVE-2026-33245React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
High 8.0
In plain English
A high-severity cross-site scripting in react-router from remix-run. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | react-router | 7.13.2 | GHSA-8646-j5j9-6r62 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| remix-run | react-router | >= 7.7.0, < 7.13.2 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N