Volerion logoVolerion
Volerion logoVolerion

React Router Cross-Site Scripting Vulnerability in Framework Mode with Pre-rendering

Vulnerability

A Cross-Site Scripting (XSS) vulnerability has been identified in React Router versions 7.5.1 prior to 7.13.2. This issue arises when Framework Mode is used with pre-rendering enabled, allowing improper handling of the HTTP Location header. If the redirect location is sourced from an untrusted entity, it can lead to XSS in the statically generated HTML files. This vulnerability does not affect applications using Declarative Mode or Data Mode.

Impact

Exploitation of this vulnerability allows for Cross-Site Scripting (XSS) attacks, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can upgrade to React Router version 7.13.2 or later to address this vulnerability.

Added: Jun 2, 2026, 5:27 PM
Updated: Jun 2, 2026, 5:27 PM

Vulnerability Rating

Custom Algorithm
spread
0.0
impact
1.7
exploitability
6.4
remediation
0.0
relevance
9.8
threat
0.0
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.