PT-2026-45826 · Unknown · React Router

X4Cc3 · CVE-2026-33245 · Published 2026-06-02 · Updated 2026-06-04

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions React Router versions 7.7.0 through 7.13.1

Description A client-side Cross-Site Scripting (XSS) issue exists in the redirect handling of the unstable React Server Components (RSC) APIs. This occurs when redirects originate from untrusted sources. This issue only affects applications utilizing the unstable RSC APIs.

Recommendations Update to version 7.13.2. As a temporary mitigation, avoid using the unstable RSC APIs if redirects from untrusted sources cannot be validated.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-33245

GHSA-8646-J5J9-6R62

Affected Products

React Router

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33245.json · Exploit
• https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33245 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33245 · Security Note
• https://osv.dev/vulnerability/GHSA-8646-j5j9-6r62 · Vendor Advisory
• https://github.com/remix-run/react-router · Note
• https://t.me/cveNotify/166069 · Telegram Post
• https://twitter.com/dailycve/status/2062317003122135469 · Twitter Post