The vulnerability resides in the RSCErrorHandler of React Router, which lacks protocol validation. This deficiency enables redirects originating from untrusted sources, leading to Cross‑Site Scripting attacks. The weakness corresponds to CWE‑79 and can grant attackers the ability to inject malicious scripts or force navigation to attacker‑controlled domains. The impact is limited to applications that consume React Router through unstable RSC APIs, but when exploited it can compromise confidentiality and integrity of user data within the affected application.

The affected vendor is remix‑run, product React Router. Versions from 7.11.0 up to and including 7.17.0 are vulnerable; the issue was addressed in 7.18.0. Any deployment relying on the unstable RSC APIs in those releases is at risk.

The CVSS score of 6.9 indicates moderate severity. EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog. Likely attackers can exploit the flaw by crafting a malicious redirect URL that is processed by the RSCErrorHandler; however, the vulnerability only manifests when an application relies on the unstable RSC APIs, reducing its broad applicability. The attack vector is inferred to be via a manipulated redirect origin rather than an arbitrary exploitation surface.