What is the CVSS score of CVE-2026-33245?

CVE-2026-33245 has a CVSS 3.1 base score of 4.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of React Router are affected by CVE-2026-33245?

React Router versions 7.7.0 through 7.13.1 contain a client-side cross-site scripting vulnerability that could allow attackers to execute malicious code in users' browsers if they follow untrusted…. A patch is available.

How to fix or mitigate CVE-2026-33245?

Within 24 hours: Audit all React Router deployments to identify applications using unstable React Server Components (RSC) APIs-non-RSC deployments are not affected. Within 7 days: Initiate upgrade to React Router 7.13.2 across all affected applications, prioritizing production and customer-facing services. Within 30 days: Complete deployment of 7.13.2, verify functionality post-upgrade, and document remediation in change logs.

React Router CVE-2026-33245

EUVD-2026-33988 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-02 GitHub_M

GHSA-8646-j5j9-6r62

XSS React Router

4.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.7 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

SUSE

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Red Hat

4.2 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jul 22, 2026 - 19:22 NVD

HIGH MEDIUM

CVSS changed

Jul 22, 2026 - 19:22 NVD

8.0 (HIGH) 4.7 (MEDIUM)

Patch available

Jun 02, 2026 - 21:02 EUVD

Analysis Generated

Jun 02, 2026 - 20:23 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

11 npm packages depend on react-router (8 direct, 3 indirect)

Ecosystem-wide dependent count for version 7.7.0.

DescriptionNVD

React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.

AnalysisAI

Client-side cross-site scripting in React Router 7.7.0 through 7.13.1 allows remote attackers to execute arbitrary script in a victim's browser when the application uses the unstable React Server Components (RSC) APIs and processes redirects originating from untrusted sources. The flaw is patched in 7.13.2; no public exploit identified at time of analysis and the vulnerability does not affect deployments that do not opt into the RSC APIs.

Technical ContextAI

React Router is the de facto routing library for React single-page and server-rendered applications, maintained by Remix (cpe:2.3:a:remix-run:react-router). The issue resides in the unstable React Server Components (RSC) redirect handling code path, which serializes redirect targets received from the server and re-emits them on the client. Because that target was not sanitized or constrained to safe URL schemes (e.g., http/https), an attacker-controlled redirect value can carry an executable payload such as a javascript: URI, fulfilling the CWE-79 (Improper Neutralization of Input During Web Page Generation) pattern as a DOM-style XSS sink reached via navigation rather than via rendered markup.

RemediationAI

Vendor-released patch: upgrade react-router to 7.13.2 or later, which corrects the RSC redirect handling per advisory GHSA-8646-j5j9-6r62 (https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62). If immediate upgrade is not possible, the most direct compensating control is to stop using the unstable RSC APIs until patched, since the rest of the router is unaffected; alternatively, validate every redirect target before passing it into the RSC redirect helpers by allow-listing same-origin paths or http(s) absolute URLs and rejecting javascript:, data:, and vbscript: schemes, accepting the trade-off that any legitimate cross-scheme redirect flow will need to be re-architected. Tightening a Content-Security-Policy to forbid inline script execution (no unsafe-inline, no javascript: in navigate-to) will blunt exploitation but may break existing inline handlers and should be tested in staging.