| Package | Affected versions | Patched versions |
|---|---|---|
| react-router | ≥ 7.5.1, < 7.13.2 | 7.13.2 |
| react-router | ≥ 7.5.1, < 7.13.2 | 7.13.2 |
When using React Router v7 Framework Mode with Pre-rendering enabled, an improper neutralization of the HTTP Location header value can permit Cross-Site Scripting (XSS) in statically generated HTML files if the redirect location comes from an untrusted source.
[!NOTE] This does not impact your React Router application if you are using Declarative Mode (
<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free