Cross-site scripting in React Router - CVE-2026-33244
Published: June 19, 2026
Vulnerability identifier: #VU134923
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-33244
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary script in the victim's browser.
The vulnerability exists due to cross-site scripting in prerendered redirect HTML generation when processing an untrusted HTTP Location header value. A remote user can supply a crafted redirect location to execute arbitrary script in the victim's browser.
Only applications using Framework Mode with pre-rendering enabled are vulnerable. User interaction is required to load the generated HTML file.
Affected software
React Router
IBM SPSS Collaboration and Deployment Services
IBM SPSS Collaboration and Deployment Services
How to mitigate CVE-2026-33244
Install security update from vendor's website.
React Router - update to 7.13.2
IBM SPSS Collaboration and Deployment Services - update to 9.0.0.0.0 IF13
IBM SPSS Collaboration and Deployment Services - update to 9.0.0.0.0 IF13