Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🔴 #React Router, XSS via RSC Redirect Handling, #CVE-2026-33245 (Critical) -DC-Jun2026-161 https://dailycve.com/react-router-xss-via-rsc-redirect-handling-cve-2026-33245-critical-dc-jun2026-161/
Post summary
A critical Cross‑Site Scripting vulnerability (CVE-2026-33245) has been disclosed in React Router’s RSC redirect handling.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | shopify | react-router | - | node.js | - |