CVE-2026-33244: React Router XSS in Framework Mode with Pre-rendering

Technical summary

The vulnerability stems from improper sanitization of the HTTP Location header when Framework Mode processes redirects during the pre-rendering phase. When a redirect target originates from an untrusted source—such as user input or external data—the Location header value is not adequately neutralized before being embedded into statically generated HTML. This allows an attacker to craft a malicious redirect URL containing JavaScript payloads (e.g., `javascript:alert(1)` or data URIs) that execute in the context of the pre-rendered page. The flaw is specific to Framework Mode's static generation pipeline and does not manifest in Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`), both of which handle runtime routing without the same pre-rendering constraints.

Business impact

Teams relying on React Router's Framework Mode with static pre-rendering for performance or hosting optimization face a supply-chain risk: compromised or malicious redirect data baked into production HTML at build time can serve XSS payloads to end users without requiring runtime exploitation. This is particularly concerning for applications that accept redirect parameters from query strings, APIs, or user-controlled sources. Affected organizations must patch before deploying new builds or re-rendering existing static assets. The Medium CVSS score (5.4) reflects that exploitation requires user interaction and valid authentication to the application.

Affected systems

Only Shopify's React Router library versions 7.5.1 through 7.13.1 are affected, and only when Framework Mode is explicitly configured with pre-rendering enabled. Applications using Declarative Mode or Data Mode are unaffected. Organizations should audit their React Router configuration to confirm which routing mode is in use.

Exploitability

Exploitation requires three conditions: (1) use of Framework Mode with pre-rendering, (2) a redirect target derived from an untrusted source at build time, and (3) a user clicking a link to or visiting the pre-rendered page. The attack surface is limited to applications that dynamically generate redirects during static site generation, making this a niche but serious risk for certain use cases. No known public exploits exist, and the vulnerability is not yet tracked in the CISA Known Exploited Vulnerabilities catalog.

Remediation

Upgrade React Router to version 7.13.2 or later as soon as feasible. For applications on vulnerable versions, perform a full rebuild and static asset regeneration after patching to ensure pre-rendered HTML files no longer contain the unmitigated Location header values. Review any redirect logic in Framework Mode to confirm that redirect targets are validated or hardcoded rather than sourced from user input or untrusted APIs.

Patch guidance

Update the react-router package to version 7.13.2 or later via your package manager (npm, yarn, pnpm). After updating, rebuild your static assets or run your pre-rendering pipeline to regenerate HTML files with the patched code. Verify the update in your lock file and test redirect behavior in a staging environment before production deployment. Check the official Shopify React Router repository and release notes to confirm patch availability and any migration notes.

Detection guidance

Inspect your package.json and lock files for react-router versions 7.5.1–7.13.1. If found, confirm your routing configuration: check for `frameWorks` or `framework` mode setup and pre-rendering or static generation configuration. Review build logs and generated HTML files for evidence of pre-rendering. Monitor application logs for unusual redirect patterns or XSS attempts targeting redirect parameters. Use standard web application firewall (WAF) rules to detect JavaScript payloads in HTTP Location headers or query parameters.

Why prioritize this

Although rated Medium severity, this vulnerability should be addressed promptly because: (1) it affects the build-time artifact layer, meaning fixes persist across deployments, (2) organizations using Framework Mode with pre-rendering often serve high-traffic static content, and (3) patching is straightforward and low-risk. However, if your application does not use Framework Mode or does not accept untrusted redirect sources, remediation can be deferred in favor of higher-impact vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 5.4 (Medium) reflects a network-exploitable XSS flaw with low attack complexity and limited scope (stored in pre-rendered HTML). The score is tempered by the requirement for user interaction (UI:R), a valid login (PR:L), and the limited confidentiality and integrity impact (C:L/I:L). The score does not account for the niche use case (Framework Mode + pre-rendering), which further reduces practical exploitability across the broader React ecosystem.

Frequently asked questions