CVE-2026-33244

[CVE catalog]

A flaw was found in react-router. When using Framework Mode with pre-rendering enabled, an attacker can exploit improper handling of the HTTP `Location` header value. This can lead to Cross-Site Scripting (XSS), allowing malicious scripts to be injected into statically generated HTML files if the redirect location originates from an untrusted source. react-router: React Router: Cross-Site Scripting (XSS) via improper HTTP Location header neutralization This Moderate flaw in `react-router` affects applications using Framework Mode with pre-rendering enabled, allowing cross-site scripting (XSS). An untrusted HTTP `Location` header can inject malicious scripts into statically generated HTML. Red Hat products are only vulnerable if deployed with this specific configuration, as Declarative Mode and Data Mode applications are unaffected. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity

Medium · CVSS 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Published

Jun 2, 2026, 4:59:31 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.14% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "react-router",
      "fixed_version": "7.13.2",
      "applicability_unknown": true
    },
    {
      "name": "react-router",
      "ecosystem": "npm",
      "provider_url": "https://github.com/advisories/GHSA-f22v-gfqf-p8f3",
      "fixed_version": "7.13.2",
      "provider_source": "github",
      "provider_record_id": "GHSA-F22V-GFQF-P8F3",
      "provider_updated_at": "2026-09-08T16:28:03Z"
    }
  ]
}