REDHAT-BUG-2484123: XSS
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
React Routerto a version that resolves this vulnerability.Fixed in 7.13.2
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2484123?
The severity of REDHAT-BUG-2484123 is classified as medium, with a score of 4.
What type of vulnerability is associated with REDHAT-BUG-2484123?
REDHAT-BUG-2484123 is associated with a Cross-Site Scripting (XSS) vulnerability.
How do I fix REDHAT-BUG-2484123?
To fix REDHAT-BUG-2484123, upgrade React Router to a version later than 7.13.1.
What versions of React Router are affected by REDHAT-BUG-2484123?
Versions 7.7.0 through 7.13.1 of React Router are affected by REDHAT-BUG-2484123.
What causes the vulnerability described in REDHAT-BUG-2484123?
The vulnerability in REDHAT-BUG-2484123 is caused by potential client-side XSS during redirect handling with untrusted sources when using React Server Components APIs.