CVE-2026-34077

A flaw was found in React Router (versions 7.7.0 through 7.13.1). When using the unstable React Server Components (RSC) APIs, insufficient sanitization of redirect targets allows client-side cross-site scripting if redirects originate from untrusted sources. An attacker could inject script that disrupts application availability for the victim user. Applications not using the unstable RSC APIs are not affected. Fixed in React Router 7.13.2.

React Router is vulnerable to client-side XSS in unstable RSC redirect handling when redirects come from untrusted sources. A remote unauthenticated attacker who can cause a victim to follow a crafted redirect (user interaction required) may execute script in the browser context, leading to denial of service. Only affects deployments using unstable RSC APIs (versions 7.7.0–7.13.1); patched in 7.13.2. Affects npm react-router bundles across OpenShift console plugins, AAP, GitOps, RHACM, and other hybrid products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.