CVE-2026-33245

React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.

CVSS v3 8.0 HIGH

8.0^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2026-06-02 20:16

Updated : 2026-07-22 19:10

NVD link : CVE-2026-33245

Mitre link : CVE-2026-33245

CVE.ORG link : CVE-2026-33245

JSON object : View

Products Affected

shopify

react-router

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-33245", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33245", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-03T19:09:10.638554Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "remix-run", "product": "react-router", "versions": [{"status": "affected", "version": ">= 7.7.0, < 7.13.2"}]}]}], "published": "2026-06-02T20:16:34.367", "references": [{"url": "https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2."}, {"lang": "es", "value": "React Router es un router para React. En las versiones 7.7.0 a la 7.13.1, al usar las API inestables de React Server Components (RSC) de React Router, existe una potencial vulnerabilidad de Cross-Site Scripting (XSS) del lado del cliente en el manejo de redirecciones de RSC si las redirecciones provienen de fuentes no confiables. Esto no tiene impacto en las aplicaciones que no est\u00e1n usando las API inestables de RSC en React Router. Esto est\u00e1 parcheado en la versi\u00f3n 7.13.2."}], "lastModified": "2026-07-22T19:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "C2AE5793-49DC-4B7A-A844-267AF5EE9080", "versionEndExcluding": "7.13.2", "versionStartIncluding": "7.7.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}