Security: React Router high-severity vulnerabilities — XSS, RCE via turbo-stream deserialization, stored XSS via Location header

[LucasMaupin]

Summary

react-router ^7.13.0 and react-router-dom ^7.13.0 have multiple high-severity vulnerabilities discovered via npm audit:

CVE/GHSA	CVSS	Description
GHSA-49rj-9fvp-4h2h	8.1	turbo-stream deserialization allows arbitrary constructor invocation (RCE risk in SSR contexts)
GHSA-8646-j5j9-6r62	8.0	XSS in RSC redirect handling — malicious redirect URLs can inject scripts
GHSA-f22v-gfqf-p8f3	7.5	Stored XSS via unescaped Location response header in redirect responses

Although this app appears to be a client-side SPA (not SSR), the stored XSS vulnerabilities (GHSA-f22v-gfqf-p8f3) are relevant in any deployment.

Affected File

package.json:

"react-router": "^7.13.0",
"react-router-dom": "^7.13.0"

Severity

High (CVSS 8.1 / 8.0)

Fix

Upgrade to the latest patched React Router v7 release:

npm install react-router@latest react-router-dom@latest
npm audit --audit-level=high

Verify the React Router changelog for the minimum version that addresses all three advisories.