CVE-2026-33245

A flaw was found in React Router. This vulnerability, a type of Cross-Site Scripting (XSS), affects applications utilizing React Router's unstable React Server Components (RSC) APIs. A remote attacker could exploit this by sending untrusted redirects, leading to the execution of malicious scripts in the client's browser. This could result in information disclosure or unauthorized actions.

This vulnerability is rated as Moderate impact for Red Hat products because successful exploitation requires an application to implement experimental React Server Components features alongside unvalidated external navigation targets. Red Hat web applications and management consoles typically utilize standard routing interfaces and do not consume arbitrary, user-controlled navigation paths within server-driven components. Consequently, supported deployments are not exposed to client-side script execution through this vector under typical usage.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this Cross-Site Scripting (XSS) vulnerability, ensure that applications utilizing React Router's unstable React Server Components (RSC) APIs only process redirects from trusted sources. Avoiding the use of these unstable APIs in production environments where untrusted redirect sources cannot be guaranteed is also recommended.