Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the HTTP `Location` header value can permit Cross-Site Scripting (XSS) in the statically generated HTML files if the redirect location comes from an untrusted source. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.13.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE取得しました〜 CVE-2026-33244 軽微なものではありますが、React RouterのXSSの脆弱性です。 パッチはだいぶ前に公開されているので適切にアップデートすることを推奨します。 https://github.com/remix-run/react-router/security/advisories/GHSA-f22v-gfqf-p8f3 #security #react #react_router #CVE
Post summary
The post announces CVE-2026-33244, an XSS vulnerability in React Router, and recommends applying the publicly released patch.
🟠 #React Router: Stored Cross-Site Scripting via Unescaped Location Header in Prerendered Redirect #HTML (#CVE‑2026‑33244) (Medium) -DC-Jun2026-156 https://dailycve.com/react-router-stored-cross-site-scripting-via-unescaped-location-header-in-prerendered-redirect-html-cve-2026-33244-medium-dc-jun2026-156/
Post summary
This tweet announces CVE‑2026‑33244, a stored XSS flaw in React Router, giving basic technical details but no PoC, exploit code, active exploitation evidence, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | shopify | react-router | - | node.js | - |