CVE-2026-33244

A flaw was found in react-router. When using Framework Mode with pre-rendering enabled, an attacker can exploit improper handling of the HTTP Location header value. This can lead to Cross-Site Scripting (XSS), allowing malicious scripts to be injected into statically generated HTML files if the redirect location originates from an untrusted source.

This Moderate flaw in react-router affects applications using Framework Mode with pre-rendering enabled, allowing cross-site scripting (XSS). An untrusted HTTP Location header can inject malicious scripts into statically generated HTML. Red Hat products are only vulnerable if deployed with this specific configuration, as Declarative Mode and Data Mode applications are unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, Red Hat customers should ensure that applications utilizing React Router avoid Framework Mode with pre-rendering enabled, particularly when handling redirect locations from untrusted sources. If this mode is essential, strict validation and sanitization of all input used in redirect URLs are required. Applications configured with Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) are not susceptible to this flaw.