EUVD-2026-49629
GHSA-h8fp-f39c-q6mh
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AC:H reflects the non-default unstable RSC API requirement; S:C and C:H reflect XSS scope escape with session-theft potential; I:L for limited DOM manipulation; A:N as availability is unaffected.
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4Blast Radius
ecosystem impact- 22 npm packages depend on react-router (7 direct, 15 indirect)
Ecosystem-wide dependent count for version 7.11.0.
DescriptionNVD
This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the (unstable) RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect targets
> [!NOTE] > This only affects your application if you are using the unstable RSC APIs
AnalysisAI
Cross-site scripting in React Router's unstable RSC (React Server Components) error handling path allows network-based attackers to execute arbitrary JavaScript in a victim's browser via attacker-controlled redirect targets. Affected are React Router npm versions 7.11.0 through 7.17.x when the unstable RSC APIs are explicitly enabled; the vulnerability arises because the RSCErrorHandler component failed to validate the protocol of redirect URLs before assigning them to window.location.href or injecting them into a meta http-equiv='refresh' tag. This is a follow-up to GHSA-8646-j5j9-6r62, indicating the prior fix left a residual code path unvalidated. No public exploit code or CISA KEV listing is identified at time of analysis.
Technical ContextAI
React Router v7 (pkg:npm/react-router) introduced experimental React Server Components (RSC) support. The RSCErrorHandler component in packages/react-router/lib/hooks.tsx is responsible for handling redirect responses that surface as errors from the RSC render pipeline. In the vulnerable code path, redirect targets sourced from untrusted RSC responses were parsed and passed directly - without protocol validation - to window.location.href (client-side) and to a meta http-equiv='refresh' content attribute (server-side no-JS path). CWE-79 (Improper Neutralization of Input During Web Page Generation, XSS) applies because attacker-supplied values like 'javascript:...' or 'about:' scheme URLs were reflected into execution contexts without sanitization. The fix imports hasInvalidProtocol from the router module and applies it before any URL is consumed, blocking non-http(s) schemes in redirect targets.
RemediationAI
Upgrade react-router to version 7.18.0 or later; this is the vendor-confirmed patched release per the GitHub advisory GHSA-h8fp-f39c-q6mh and CHANGELOG at https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180. The fix is implemented via commit ce596e823f0d7b883a433af1d5a839a8b9fe0242 (PR #15177). If an immediate upgrade is not possible, the most effective workaround is to disable or avoid use of the unstable RSC APIs entirely, as the vulnerability is exclusively in that code path; removing RSC API usage eliminates exposure with no other functional trade-off for stable-API consumers. There is no known in-place configuration knob to harden the RSCErrorHandler without patching.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server 16.0 | Not-Affected |
| SUSE Linux Enterprise Server 16.0 | Not-Affected |
| SUSE Linux Enterprise Server 16.1 | Not-Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Not-Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Not-Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Not-Affected |
| SUSE Manager Client Tools 15 | Not-Affected |
| SUSE Manager Client Tools for SLE 15 | Not-Affected |
| SUSE Multi-Linux Manager Client Tools for SLE 15 | Not-Affected |
| openSUSE Leap 16.0 | Not-Affected |
| openSUSE Leap 16.0 | Affected |
| openSUSE Leap 16.0 | Not-Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Manager Proxy LTS 4.3 | Not-Affected |
| SUSE Manager Proxy Module 4.3 | Not-Affected |
| SUSE Enterprise Storage 6 | Not-Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Not-Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Not-Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP3 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP5 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Affected |
| SUSE Manager Proxy Module 4.1 | Not-Affected |
| SUSE Manager Proxy Module 4.2 | Not-Affected |
| openSUSE Leap 15.3 | Not-Affected |
| openSUSE Leap 15.4 | Not-Affected |
| openSUSE Leap 15.5 | Not-Affected |
| openSUSE Leap 15.6 | Not-Affected |
| SUSE Multi Linux Manager Tools SLE-15 | Not-Affected |
| ses/7.1/ceph/prometheus-server ses/7/ceph/prometheus-server suse/multi-linux-manager/5.2/x86_64/monitoring-prometheus | Not-Affected |
Share
External POC / Exploit Code
Leaving vuln.today