{"id":"CVE-2026-33244","aliases":["GHSA-f22v-gfqf-p8f3"],"title":"React Router has stored XSS via unescaped Location header in prerendered redirect HTML","summary":"React Router has stored XSS via unescaped Location header in prerendered redirect HTML","severity":"medium","cvss":5.4,"cwe":["CWE-79"],"vendor":"react-router","product":"react-router","ecosystem":"npm","affected":["react-router >= 7.5.1, < 7.13.2"],"patched":["react-router 7.13.2"],"published":"2026-06-03","updated":"2026-09-08","sourceUpdated":"2026-09-08T16:28:03Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-f22v-gfqf-p8f3","references":[{"url":"https://github.com/remix-run/react-router/security/advisories/GHSA-f22v-gfqf-p8f3"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33244"},{"url":"https://github.com/remix-run/react-router/pull/14880"},{"url":"https://github.com/remix-run/react-router/commit/ea28e66926460656815cee9b7f2dfaa872513a8c"},{"url":"https://github.com/remix-run/react-router/blob/react-router%407.13.2/CHANGELOG.md#v7132"},{"url":"https://github.com/advisories/GHSA-f22v-gfqf-p8f3"}],"tags":["ghsa","npm"],"epss":0.00144,"epssPercentile":0.04103,"ingestedAt":"2026-09-08T17:06:31.882Z","slug":"CVE-2026-33244","body":"## Overview\n\nWhen using React Router v7 [Framework Mode](https://reactrouter.com/start/modes#framework) with [Pre-rendering](https://reactrouter.com/how-to/pre-rendering) enabled, an improper neutralization of the HTTP `Location` header value can permit Cross-Site Scripting (XSS) in statically generated HTML files if the redirect location comes from an untrusted source.\n\n> [!NOTE]\n> This does not impact your React Router application if you are using [Declarative Mode](https://reactrouter.com/start/modes#declarative) (`<BrowserRouter>`) or [Data Mode](https://reactrouter.com/start/modes#data) (`createBrowserRouter`/`<RouterProvider>`).\n\n## Affected packages\n\n- `react-router >= 7.5.1, < 7.13.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `react-router 7.13.2`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}