{"id":"CVE-2026-33244","title":"react-router: React Router: Cross-Site Scripting (XSS) via improper HTTP Location header neutralization (CVE-2026-33244)","summary":"A flaw was found in react-router. When using Framework Mode with pre-rendering enabled, an attacker can exploit improper handling of the HTTP `Location` header value. This can lead to Cross-Site Scripting (XSS), allowing malicious scripts …","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvssSource":"vendor","cwe":"CWE-79","vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","affected":["cryostat 4","exploit_intelligence","gatekeeper 3","migration_toolkit_for_applications 8","migration_toolkit_for_containers","migration_toolkit_for_virtualization","multicluster_engine_for_kubernetes","network_observability_operator","node_healthcheck_operator","openshift_lightspeed","openshift_pipelines","openshift_service_mesh 2","openshift_service_mesh 3","advanced_cluster_management_for_kubernetes 2","advanced_cluster_security 4","amq_broker 7","ansible_automation_platform 2","build_of_apache_camel_hawtio 4","build_of_apache_camel_for_spring_boot 4","build_of_apicurio_registry 2","build_of_apicurio_registry 3","build_of_keycloak","build_of_podman_desktop","ceph_storage 5","ceph_storage 9","data_grid 8","developer_hub","discovery 2","edge_manager 1","enterprise_linux 10","enterprise_linux 8","enterprise_linux 9","fuse 7","jboss_enterprise_application_platform 8","jboss_enterprise_application_platform_expansion_pack","openshift_ai_rhoai","openshift_container_platform 4","openshift_data_foundation 4","openshift_dev_spaces","openshift_distributed_tracing 3"],"patched":["react-router 7.13.2"],"published":"2026-06-02","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:35:25+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33244.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33244.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-33244"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484045"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33244"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33244"},{"url":"https://github.com/remix-run/react-router/security/advisories/GHSA-f22v-gfqf-p8f3"},{"url":"https://github.com/remix-run/react-router/pull/14880"},{"url":"https://github.com/remix-run/react-router/commit/ea28e66926460656815cee9b7f2dfaa872513a8c"},{"url":"https://github.com/remix-run/react-router/blob/react-router%407.13.2/CHANGELOG.md#v7132"},{"url":"https://github.com/advisories/GHSA-f22v-gfqf-p8f3"}],"tags":["csaf","vex","red-hat","ghsa","npm"],"epss":0.00144,"epssPercentile":0.03697,"aliases":["GHSA-f22v-gfqf-p8f3"],"ecosystem":"npm","ingestedAt":"2026-09-08T17:06:31.882Z","slug":"CVE-2026-33244","body":"## Overview\n\nA flaw was found in react-router. When using Framework Mode with pre-rendering enabled, an attacker can exploit improper handling of the HTTP `Location` header value. This can lead to Cross-Site Scripting (XSS), allowing malicious scripts to be injected into statically generated HTML files if the redirect location originates from an untrusted source.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Cryostat 4, Exploit Intelligence, Gatekeeper 3, Migration Toolkit for Applications 8, Migration Toolkit for Containers, Migration Toolkit for Virtualization, … · no fix planned: Cryostat 4, Exploit Intelligence, Gatekeeper 3, Migration Toolkit for Applications 8, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33244.json)\n\n**react-router: React Router: Cross-Site Scripting (XSS) via improper HTTP Location header neutralization** — rated Moderate by Red Hat. Released 2026-06-02, updated 2026-10-15.\n\nAffected:\n\n- Cryostat 4\n- Exploit Intelligence\n- Gatekeeper 3\n- Migration Toolkit for Applications 8\n- Migration Toolkit for Containers\n- Migration Toolkit for Virtualization\n- Multicluster Engine for Kubernetes\n- Network Observability Operator\n- Node HealthCheck Operator\n- OpenShift Lightspeed\n- OpenShift Pipelines\n- OpenShift Service Mesh 2\n- OpenShift Service Mesh 3\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Advanced Cluster Security 4\n- Red Hat AMQ Broker 7\n- Red Hat Ansible Automation Platform 2\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat build of Apache Camel for Spring Boot 4\n- Red Hat build of Apicurio Registry 2\n- Red Hat build of Apicurio Registry 3\n- Red Hat Build of Keycloak\n- Red Hat Build of Podman Desktop\n- Red Hat Ceph Storage 5\n- Red Hat Ceph Storage 9\n- Red Hat Data Grid 8\n- Red Hat Developer Hub\n- Red Hat Discovery 2\n- Red Hat Edge Manager 1\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Fuse 7\n- Red Hat JBoss Enterprise Application Platform 8\n- Red Hat JBoss Enterprise Application Platform Expansion Pack\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat OpenShift distributed tracing 3\n\nNo fix planned:\n\n- Cryostat 4\n- Exploit Intelligence\n- Gatekeeper 3\n- Migration Toolkit for Applications 8\n- Migration Toolkit for Containers\n- Migration Toolkit for Virtualization\n- Multicluster Engine for Kubernetes\n- Network Observability Operator\n- Node HealthCheck Operator\n- OpenShift Lightspeed\n- OpenShift Pipelines\n- OpenShift Service Mesh 2\n- OpenShift Service Mesh 3\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Advanced Cluster Security 4\n- Red Hat AMQ Broker 7\n- Red Hat Ansible Automation Platform 2\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat build of Apache Camel for Spring Boot 4\n- Red Hat build of Apicurio Registry 2\n- Red Hat build of Apicurio Registry 3\n- Red Hat Build of Keycloak\n- Red Hat Build of Podman Desktop\n- Red Hat Ceph Storage 5\n- Red Hat Ceph Storage 9\n- Red Hat Data Grid 8\n- Red Hat Developer Hub\n- Red Hat Discovery 2\n- Red Hat Edge Manager 1\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Fuse 7\n- Red Hat JBoss Enterprise Application Platform 8\n- Red Hat JBoss Enterprise Application Platform Expansion Pack\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat OpenShift distributed tracing 3\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- To mitigate this issue, Red Hat customers should ensure that applications utilizing React Router avoid Framework Mode with pre-rendering enabled, particularly when handling redirect locations from untrusted sources. If this mode is essential, strict validation and sanitization of all input used in redirect URLs are required. Applications configured with Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`) are not susceptible to this flaw.\n\n## Package advisory (CVE-2026-33244)\n\nAffected packages:\n\n- `react-router >= 7.5.1, < 7.13.2`\n\nPatched in:\n\n- `react-router 7.13.2`\n\nSource: https://github.com/advisories/GHSA-f22v-gfqf-p8f3","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}