React Router versions 7.7.0 through 7.13.1 contain a client‑side XSS vulnerability that is triggered when redirects from untrusted sources are processed by the unstable React Server Components APIs. An attacker can inject malicious JavaScript into the browser session of a user who follows a crafted link, potentially exposing sensitive data or enabling phishing attacks. The flaw stems from improper handling of redirect URLs and is classified as CWE‑79.

The affected products are remix‑run:react‑router and remix‑run:turbo‑stream, with versions 7.7.0 through 7.13.1 impacted. The issue is resolved in version 7.13.2 and newer releases.

The CVSS score of 7.5 indicates a high severity rating. An EPSS score of <1% suggests that, while the vulnerability can be exploited, its likelihood remains low. The flaw is not listed in the CISA KEV catalog. Exploitation requires a web application that employs the unstable RSC APIs and an attacker who delivers a crafted redirect target. Because the flaw is client‑side, the attack can be initiated simply by opening a malicious link, but the impact is limited to the victim’s browser session. Until updated to a fixed release, installations using the vulnerable versions are at risk.