CVE-2026-33244Medium· 5.4▾ SunlitA flaw was found in react-router. When using Framework Mode with pre-rendering enabled, an attacker can exploit improper handling of the HTTP `Location` header value. This can lead to Cross-Site Scripting (XSS), allowing malicious scripts …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.1%
0.1% → 0.2%
Last analysed / modified upstream
A flaw was found in react-router. When using Framework Mode with pre-rendering enabled, an attacker can exploit improper handling of the HTTP Location header value. This can lead to Cross-Site Scripting (XSS), allowing malicious scripts to be injected into statically generated HTML files if the redirect location originates from an untrusted source.
react-router: React Router: Cross-Site Scripting (XSS) via improper HTTP Location header neutralization — rated Moderate by Red Hat. Released 2026-06-02, updated 2026-10-15.
Affected:
No fix planned:
Fix deferred
Workarounds / mitigations:
<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) are not susceptible to this flaw.Affected packages:
react-router >= 7.5.1, < 7.13.2Patched in:
react-router 7.13.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-66010Medium· 6.1dompurify: DOMPurify: Cross-Site Scripting (XSS) via custom element attribute bypass (CVE-2026-66010)
CVE-2026-114127Medium· 5.4astro: Astro: CSS injection via unvalidated view transition animation properties (CVE-2026-114127)
CVE-2026-114128Medium· 6.1astro: astro: Cross-Site Scripting via unescaped dynamic content in script and style elements (CVE-2026-114128)
CVE-2026-73088High· 7.5Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools
CVE-2026-73089High· 7.5Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools
CVE-2026-12590Medium· 5.9body-parser: body-parser: Denial of Service via invalid limit option (CVE-2026-12590)