CVE-2026-33245: React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

Synopsis

This is a client-side Cross-Site Scripting (XSS) vulnerability in the React Router library, specifically in its unstable React Server Components (RSC) redirect handling. The flaw is reachable over the network without authentication, but requires a victim to interact with a page and involves higher attack complexity due to the need to supply a malicious redirect target (such as a javascript: URI) from an untrusted source. Successful exploitation gives an attacker the ability to execute arbitrary JavaScript in the victim's browser, leading to session theft, credential harvesting, or unauthorized actions on behalf of the user. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the target application over the network and influence redirect responses served to the victim's browser.

• AuthenticationNot required

  No account or credential is needed; the attacker can operate as an unauthenticated party supplying malicious redirect targets.

• Victim interactionRequired

  A user must visit or interact with a page that triggers the vulnerable RSC redirect flow, making social engineering or malicious link delivery part of the attack path.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must meet specific conditions such as controlling or poisoning a redirect source that the RSC handler treats as trusted.

Blast Radius

• Reads browser session tokens, authentication cookies, and other credentials accessible to the injected script running in the victim's origin context.
• Exfiltrates sensitive page content or form data visible to the victim at the time of exploitation.
• Performs unauthorized actions in the application on behalf of the victim, such as submitting forms or triggering state changes.