CVE-2026-33244
Fixed in a distro release EPSS <1%CVSS 5.4
React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the HTTP `Location` header value can permit Cross-Site Scripting (XSS) in the statically generated HTML files if the redirect location comes from an untrusted source. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.13.2.
Products: remix-run react-router
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | react-router | 7.13.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | no fix |
| Chainguard | airflow-core-2 | no fix |
| SUSE Manager Client Tools 15 | golang-github-prometheus-alertmanager | 0.28.1-150100.4.34.1 |
| SUSE Manager Client Tools 15 | golang-github-prometheus-prometheus | 3.5.4-150000.3.75.1 |
| SUSE Manager Client Tools 15 | grafana | 12.4.5-150000.1.98.1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-alertmanager | 0.28.1-150002.4.14.1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-prometheus | 3.5.4-150002.3.16.1 |
| SUSE Multi Linux Manager Tools SLE-15 | grafana | 12.4.5-150002.4.24.1 |