Description
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| remix-run | react-router | >= 7.0.0, < 7.14.0 | — |
| remix-run | turbo-stream | < 3.0.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | agama-web-ui | 22+143.ee15dea20-46.1 | openSUSE-SU-2026:11128-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | react-router | >= 7.0.0, < 7.14.0 | 7.14.0 | GHSA-rxv8-25v2-qmq8 |
| npm | turbo-stream | < 3.0.0 | 3.0.0 | GHSA-rxv8-25v2-qmq8 |
Advisories 3
- WID-SEC-2026-3046 IBM Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-1955 Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 23, 2026
- openSUSE-SU-2026:11128-1 agama-web-ui-22+143.ee15dea20-46.1 on GA media SUSE / openSUSE Security Updates · Jun 29, 2026