The vulnerability exists in React Router versions 7.7.0 through 7.13.1. The unstable React Server Components (RSC) redirect handling can execute untrusted javascript: URLs, leading to client-side XSS. Based on the description, it is inferred that the flaw results from a lack of validation of redirect targets (CWE-79). Based on the description, it is inferred that attackers can inject malicious scripts through redirect parameters, compromising the user’s browser and enabling credential theft or defacement.

The vendor product is remix‑run’s React Router. Affected are all installations of React Router 7.7.0 through 7.13.1 that use the unstable React Server Components APIs for redirects. Versions prior to 7.7.0 or the patched 7.13.2 and later are not vulnerable.

The CVSS score of 8 indicates high severity. EPSS data is not available, but the vulnerability is not listed in CISA KEV, implying no known mass exploitation. Based on the description, it is inferred that exploitation requires that an application accepts redirect targets from untrusted sources while using the unstable RSC APIs. Based on the description, it is inferred that an attacker controlling that input can craft a redirect URL using the javascript: scheme that executes code in the user’s browser, giving them the same privileges as the victim. Given the high score and the potential for client-side compromise, the risk is moderate‑high.