CVE-2026-33245: React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

June 3, 2026

When using React Router v7’s unstable RSC APIs, there exists a potential client-side XSS issue in the RSC redirect handling if redirects are coming from untrusted sources

[!NOTE] This only impacts your application if you are using the unstable RSC APIs in React Router.

References

github.com/advisories/GHSA-8646-j5j9-6r62
github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62
nvd.nist.gov/vuln/detail/CVE-2026-33245

Code Behaviors & Features

Detect and mitigate CVE-2026-33245 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →