CVE-2026-34077

7.5 Élevée

Publiée le 02/06/2026 à 22:16 · Modifiée le 22/07/2026 à 21:10 · Analysée par le NVD · Source : security-advisories@github.com

Description

React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.

Traduire en français

Produits concernés

remix-run react-router
remix-run turbo-stream
Shopify react-router
Turbo-stream turbo stream

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-770

Références

https://github.com/remix-run/react-router/security/advisories/GHSA-rxv8-25v2-qmq8 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories