CVE-2026-33245

What it actually does

CVE-2026-33245 is a client-side cross-site scripting issue in React Router versions 7.7.0 through 7.13.1 when applications use the unstable React Server Components APIs. If an application accepts or derives redirect destinations from untrusted input and passes them into the affected RSC redirect handling flow, React Router may process the redirect in a way that allows attacker-controlled script execution in the victim's browser. The vulnerability requires user interaction and a vulnerable application pattern, but successful exploitation can execute JavaScript in the security context of the affected web application, enabling theft of session data accessible to JavaScript, user impersonation actions, phishing overlays, or modification of page content.

Why it matters to the business

Organizations running affected React Router versions with unstable RSC APIs may expose users to browser-based compromise if redirect destinations can be influenced by an attacker. The main operational risks are account takeover, fraudulent user actions, data exposure from the application session, reputational damage, and increased support or incident response workload. Although EPSS is currently low and no public exploit maturity or KEV listing is reported, the issue has a high CVSS score because exploitation can affect confidentiality and integrity once a user follows a malicious link or interacts with attacker-controlled content.

How an attack unfolds

An attacker first identifies a React application using React Router 7.7.0 through 7.13.1 with unstable React Server Components APIs and a redirect flow that can be influenced by untrusted input, such as a query parameter, form field, server response, or user-controlled URL. The attacker crafts a URL or request that causes the vulnerable redirect handling path to receive a malicious destination or payload, commonly using script-capable schemes, encoded JavaScript, HTML injection primitives, or redirect chaining. The attacker then delivers the crafted link through phishing, messaging, a malicious website, or another channel requiring the victim to interact. When the victim opens the link and the application processes the RSC redirect, attacker-controlled JavaScript may execute in the browser under the application's origin. The attacker can then perform actions available to the victim in the application, capture tokens or data accessible to client-side code, alter the displayed page, or redirect the victim to additional phishing or malware infrastructure.

How to fix it

Upgrade React Router to version 7.13.2 or later for any application using the unstable React Server Components APIs. If immediate upgrade is not possible, disable or avoid the unstable RSC APIs where feasible, and ensure redirect destinations are never taken directly from untrusted input. Enforce strict redirect allowlists that permit only known relative paths or approved origins, reject dangerous schemes such as javascript:, data:, vbscript:, file:, and blob: unless explicitly required, and normalize and decode redirect values before validation to prevent encoded bypasses. Add defense-in-depth controls such as a restrictive Content Security Policy that avoids unsafe-inline, uses nonces or hashes for scripts, and limits connect-src, frame-src, and form-action destinations. Review application code for redirect(), navigation, loader/action response redirects, and any RSC-related redirect behavior that consumes query parameters, request headers, form values, or upstream service responses.

How to confirm the fix worked

Confirm the installed React Router version is 7.13.2 or later using the package lockfile and runtime build artifacts where applicable. Review package manifests and lockfiles for react-router versions from 7.7.0 through 7.13.1, including transitive or workspace dependencies. Confirm whether the application uses React Router unstable React Server Components APIs; applications not using those APIs are not affected by the described vulnerable path. Test redirect endpoints and RSC flows with benign payloads such as javascript:alert(1), data:text/html,<script>alert(1)</script>, encoded variants, protocol-relative URLs, and external origins, and verify they are rejected or safely normalized to allowed destinations. Validate that redirects are allowlisted after URL decoding and canonicalization. Use browser developer tools or automated security tests to confirm no attacker-controlled script executes during redirect handling after remediation.

Typical attack path

1. Fingerprint the target application to determine whether it uses React Router 7.7.0 through 7.13.1 and unstable React Server Components APIs.
2. Find a redirect flow where the redirect destination is derived from untrusted or user-controllable input.
3. Craft a malicious redirect payload using script-capable URL schemes, encoded script content, HTML/script injection, or redirect chaining.
4. Deliver the crafted URL or request to a victim through phishing, social engineering, a malicious page, or embedded content.
5. Victim interacts with the link or page, causing the application to invoke the vulnerable RSC redirect handling.
6. Malicious JavaScript executes in the victim's browser in the context of the affected application.
7. Attacker uses the browser context to steal accessible session data, perform unauthorized actions, manipulate page content, or pivot to further phishing.

How to detect it

To determine whether exploitation already occurred, review CDN, WAF, reverse proxy, application, and browser telemetry for requests to redirect-related routes, RSC endpoints, loaders, actions, or navigation flows containing script-capable schemes or encoded script content. Focus on requests with parameters commonly used for redirects, such as redirect, redirectTo, returnUrl, return_to, next, url, destination, continue, callback, callbackUrl, from, target, and location. Look for payloads using javascript:, data:text/html, vbscript:, HTML tags, event handlers such as onerror= or onload=, encoded equivalents, double-encoded values, and protocol-relative external redirects. Correlate suspicious requests with user-agent, referrer, source IP, session identifiers, subsequent account changes, new API token creation, profile or email changes, privileged actions, unusual downloads, or rapid navigation events. Review CSP violation reports, if enabled, for blocked inline script execution, script-src violations, or navigation to unexpected domains following redirect requests. Because this is a client-side XSS flaw, server logs may only show the payload delivery request; browser telemetry, CSP reports, WAF logs, and user activity audit trails are especially important.

• javascript:
• java%73cript:
• %6a%61%76%61%73%63%72%69%70%74%3a
• data:text/html
• data%3Atext%2Fhtml
• vbscript:
• %76%62%73%63%72%69%70%74%3a
• <script
• %3Cscript
• </script>
• %3C%2Fscript%3E
• onerror=
• %6f%6e%65%72%72%6f%72%3d
• onload=
• %6f%6e%6c%6f%61%64%3d
• alert(1)
• prompt(1)
• document.cookie
• localStorage
• sessionStorage
• redirect=javascript:
• redirectTo=javascript:
• returnUrl=javascript:
• return_to=javascript:
• next=javascript:
• url=javascript:
• destination=javascript:
• callbackUrl=javascript:
• continue=javascript:
• target=javascript:
• location=javascript:
• text/x-component

What your security team should do

• Prioritize inventory of applications using React Router versions 7.7.0 through 7.13.1, especially those using unstable React Server Components APIs.
• Upgrade affected applications to React Router 7.13.2 or later and redeploy production builds.
• Audit all redirect logic that accepts query parameters, form fields, headers, server responses, or other untrusted inputs, and replace permissive validation with strict allowlists.
• Add regression tests for malicious redirect payloads, including encoded javascript:, data:, vbscript:, protocol-relative, and external-origin redirects.
• Deploy or tighten Content Security Policy to reduce the impact of any residual XSS.
• Search web, CDN, WAF, and application logs for historical requests containing suspicious redirect payloads or script-capable URL schemes.
• If suspicious exploitation is found, investigate affected user sessions, revoke exposed tokens where applicable, and review account activity performed after suspicious requests.
• Monitor dependency advisories and update automation to prevent reintroduction of vulnerable React Router versions.