React Router versions 7.7.0 through 7.13.1 contain a client‑side XSS flaw that is triggered when redirects from untrusted sources are processed by the unstable React Server Components (RSC) APIs. An attacker can inject arbitrary JavaScript into the browser session of a user who follows a malicious link, potentially exposing sensitive data or enabling phishing attempts. The vulnerability stems from improper handling of redirect URLs and is categorized as a CWE‑770 flaw.

The affected products are remix‑run:react‑router and remix‑run:turbo‑stream, with versions 7.7.0 through 7.13.1 impacted. The issue is resolved in version 7.13.2 and newer releases.

The CVSS score of 7.5 reflects a high severity level. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a web application that utilizes the unstable RSC APIs and an attacker who can provide a crafted redirect target to a victim. Because the flaw is client‑side, the attack can be initiated simply by visiting a malicious link; however, the damage is confined to the victim’s browser session. Until the product is patched, the risk remains high for installations that use the vulnerable versions.