Volerion logoVolerion
Volerion logoVolerion

React Router Client-Side Cross-Site Scripting Vulnerability in Unstable RSC APIs

Vulnerability

A client-side Cross-Site Scripting (XSS) vulnerability has been identified in React Router versions 7.7.0 prior to 7.13.2. This issue arises when using the unstable React Server Components (RSC) APIs, specifically in the handling of redirects from untrusted sources. Applications not utilizing these unstable RSC APIs are not affected.

Impact

Exploitation of this vulnerability could lead to client-side Cross-Site Scripting, allowing for the injection of malicious scripts that could be executed in the context of the user's browser.

Remediation

Users can upgrade to React Router version 7.13.2 or later to address this vulnerability.

Added: Jun 2, 2026, 8:37 PM
Updated: Jun 2, 2026, 8:37 PM

Vulnerability Rating

Custom Algorithm
spread
0.0
impact
1.7
exploitability
6.2
remediation
0.0
relevance
9.8
threat
0.0
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.