CVE-2026-33244: React Router XSS in Framework Mode pre-rendering

Executive brief

React Router is a popular library used to manage navigation in web applications. A security flaw exists when the library is used in 'Framework Mode' with pre-rendering enabled, where it fails to properly clean redirect information. This could allow an attacker to inject malicious scripts into the website, potentially leading to unauthorized actions or data theft from users visiting the affected pages.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in React Router v7 when using Framework Mode with Pre-rendering enabled. The vulnerability stems from improper neutralization of the HTTP 'Location' header value during the generation of static redirect HTML files. If a redirect destination is derived from an untrusted source, an attacker can inject malicious scripts into the pre-rendered HTML. This issue specifically affects statically generated files and does not impact applications using Declarative Mode or Data Mode. The vulnerability is addressed in version 7.13.2.

Affected products

• remix-run react-router >= 7.5.1, < 7.13.2

Timeline

• 2026-06-02: disclosed
• 2026-06-03: advisory
• 2026-06-03: patched: Fixed in version 7.13.2

References

• https://api.github.com/users/yuito-it
• https://github.com/yuito-it
• https://api.github.com/users/yuito-it/gists%7B/gist_id%7D
• https://api.github.com/users/yuito-it/repos
• https://avatars.githubusercontent.com/u/132048482?v=4
• https://api.github.com/users/yuito-it/events%7B/privacy%7D