Volerion logoVolerion
Volerion logoVolerion

React Router Client-Side Cross-Site Scripting Vulnerability in Unstable React Server Components APIs

Vulnerability

A client-side Cross-Site Scripting (XSS) vulnerability has been identified in React Router versions 7.7.0 through 7.13.1. This issue arises when using the unstable React Server Components (RSC) APIs, specifically in the handling of redirects from untrusted sources. Applications not utilizing these unstable RSC APIs are not affected. The vulnerability has been patched in version 7.13.2.

Impact

Exploitation of this vulnerability could lead to client-side Cross-Site Scripting, allowing for the injection of malicious scripts that could be executed in the user's browser.

Remediation

Users are advised to upgrade to React Router version 7.13.2 or later.

Added: Jun 2, 2026, 8:35 PM
Updated: Jun 2, 2026, 8:35 PM

Vulnerability Rating

Custom Algorithm
spread
0.0
impact
1.7
exploitability
6.2
remediation
0.0
relevance
9.8
threat
0.0
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.