8
CVE-2026-33245
- EPSS 0.19%
- Veröffentlicht 02.06.2026 17:14:50
- Zuletzt bearbeitet 04.06.2026 18:43:39
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
LoginReact Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Shopify ≫ React-router SwPlatformnode.js Version >= 7.7.0 < 7.13.2
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.19% | 0.085 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.7 | 1.6 | 2.7 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
|
| security-advisories@github.com | 8 | 1.6 | 5.8 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62