Bug 2484045 (CVE-2026-33244)

Summary:	CVE-2026-33244 react-router: React Router: Cross-Site Scripting (XSS) via improper HTTP Location header neutralization
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aazores, abarbaro, abokovoy, abrianik, adudiak, alcohan, alizardo, amctagga, anjoseph, anpicker, anthomas, anujha, aoconnor, aschwart, asoldano, aszczucz, ataylor, bbaranow, bdettelb, bmaxwell, bniver, boliveir, brasmith, bstansbe, cdrage, cmah, cmyers, cochase, dbosanac, dbruscin, dhanak, dhanina, dlofthou, dnakabaa, doconnor, dranck, drichtar, drosa, dschmidt, dymurray, eaguilar, ebaron, eborisov, ehelms, ehugonne, erezende, ewittman, fdeutsch, flucifre, fmariani, frenaud, ftrivino, ggainey, ggrzybek, gmalinko, gmeno, gotiwari, gparvin, groman, hasun, ibek, ibolton, istudens, ivassile, iweiss, janstey, jbalunas, jchui, jfula, jgrulich, jhe, jhorak, jkoehler, jlanda, jmatthew, jmontleo, jolong, jowilson, jprabhak, jraez, jreimann, jrokos, juwatts, jwong, jwon, kaycoth, kbempah, kshier, ktsao, kvanderr, lball, lchilton, lcouzens, lphiri, manissin, mbenjamin, mcarlett, mdessi, mhackett, mhess, mhulan, mnovotny, mosmerov, mposolda, mrizzi, msvehla, mvyas, mwringe, nboldt, ngough, nipatil, nmoumoul, nwallace, nyancey, oaljalju, omaciel, ometelka, oramraz, osousa, pahickey, pantinor, parichar, pberan, pcattana, pcreech, pdelbell, pesilva, pgaikwad, pjindal, pmackay, prwatson, psrna, ptisnovs, rchan, rhaigner, rhel-process-autobot, rjohnson, rkubis, rmartinc, rstancel, rstepani, rushinde, sausingh, sdawley, sdoran, sfeifer, simaishi, slucidi, smaestri, smallamp, smcdonal, smullick, solenoci, sostapov, sseago, ssilvert, stcannon, sthorger, stirabos, syedriko, tasato, tcunning, teagle, thason, thjenkin, tmalecek, tpopela, vdosoudi, vereddy, veshanka, vle, vmuzikar, vwilson, watson-tool-maintainers, wtam, xdharmai, yfang, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in react-router. When using Framework Mode with pre-rendering enabled, an attacker can exploit improper handling of the HTTP `Location` header value. This can lead to Cross-Site Scripting (XSS), allowing malicious scripts to be injected into statically generated HTML files if the redirect location originates from an untrusted source.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2489182, 2489183, 2489186, 2489181, 2489184, 2489185, 2489187, 2489188
Bug Blocks:

Description OSIDB Bzimport 2026-06-02 18:01:39 UTC

React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the HTTP `Location` header value can permit Cross-Site Scripting (XSS) in the statically generated HTML files if the redirect location comes from an untrusted source. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.13.2.

Comment 2 David Hanina 2026-06-03 06:48:18 UTC

As FreeIPA goes, we can safely waive this one, as we use Declarative mode, which is not affected