Cross-site scripting in React Router - CVE-2026-33245
Published: June 19, 2026
Vulnerability identifier: #VU134924
CSH Severity: Medium
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-33245
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.
The vulnerability exists due to cross-site scripting in unstable RSC redirect handling when processing javascript: redirect targets from untrusted sources. A remote attacker can supply a crafted redirect target to execute arbitrary script in the victim's browser.
This only affects applications using the unstable RSC APIs.
Affected software
React Router
IBM SPSS Collaboration and Deployment Services
JBoss Data Grid
IBM SPSS Collaboration and Deployment Services
JBoss Data Grid
How to mitigate CVE-2026-33245
Install security update from vendor's website.
React Router - update to 7.13.2
JBoss Data Grid - update to 8.6.2
JBoss Data Grid - update to 8.6.2