HIGH🇬🇧 English

CVE-2026-33245

CVSS 8.0v3.1pub. 2026-06-02upd. 2026-07-22

React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

  • Shopify React Router

    APP
    Shopify
    7.7.0 – 7.13.2 (bez)
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
XSS
CWE
Referencje

Powiązane podatności

CVE-2026-55685HIGH8.7PL ✓ten sam produkt

React Router: Atak DoS na endpoint manifest — nadmierne obciążenie serwera

CVE-2026-42342HIGH7.5ten sam produkt

React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 throu...

CVE-2026-34077HIGH7.5ten sam produkt

React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React...

CVE-2026-42211HIGH8.1ten sam produkt

React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination...

CVE-2026-21884HIGH8.2ten sam produkt

React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 throug...