[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-33244":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T11:35:27.363Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":44,"aliases":45,"duplicate_of":9,"upstream":51,"downstream":52,"duplicates":57,"related":58,"reserved_at":9,"published_at":61,"modified_at":62,"state":63,"summary":64,"references_raw":73,"kevs":110,"epss":111,"epss_history":114,"metrics":374,"affected":386},"CVE-2026-33244","React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the HTTP `Location` header value can permit Cross-Site Scripting (XSS) in the statically generated HTML files if the redirect location comes from an untrusted source. This does not impact applications using Declarative Mode (`\u003CBrowserRouter>`) or Data Mode (`createBrowserRouter/\u003CRouterProvider>`). This is patched in version 7.13.2.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-79","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","weakness","Stable","Base","High",[20,24,28,32,36,40],{"id":21,"name":22,"techniques":23},"CAPEC-209","XSS Using MIME Type Mismatch",[],{"id":25,"name":26,"techniques":27},"CAPEC-588","DOM-Based XSS",[],{"id":29,"name":30,"techniques":31},"CAPEC-591","Reflected XSS",[],{"id":33,"name":34,"techniques":35},"CAPEC-592","Stored XSS",[],{"id":37,"name":38,"techniques":39},"CAPEC-63","Cross-Site Scripting (XSS)",[],{"id":41,"name":42,"techniques":43},"CAPEC-85","AJAX Footprinting",[],[],[46,47,48,49,50],"GHSA-f22v-gfqf-p8f3","CGA-6g55-vp2x-86rv","CGA-7r45-pxhr-7h4p","CGA-8jfc-86r7-456h","CGA-frqq-386v-7q4m",[],[53,55],{"_key":54},"SUSE-SU-2026:3713-1",{"_key":56},"SUSE-SU-2026:3714-1",[],[59,60],{"_key":54},{"_key":56},"2026-06-02T16:59:31.104Z","2026-06-02T17:28:13.207Z","Analyzed",{"cisa_kev":65,"cisa_ransomware":65,"cisa_vendor":9,"epss_severity":66,"epss_score":67,"severity":68,"severity_score":69,"severity_version":70,"severity_source":71,"severity_vector":72,"severity_status":63},false,"low",0.00144,"medium",5.4,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",[74,85,89,94,98,102,106],{"url":75,"sources":76,"tags":80},"https://github.com/remix-run/react-router/security/advisories/GHSA-f22v-gfqf-p8f3",[71,77,78,79],"nvd","osv_npm","osv_chainguard",[81,82,83,84],"X Refsource CONFIRM","Vendor Advisory","WEB","Advisory",{"url":86,"sources":87,"tags":88},"https://nvd.nist.gov/vuln/detail/CVE-2026-33244",[78,79],[84],{"url":90,"sources":91,"tags":92},"https://github.com/remix-run/react-router",[78],[93],"PACKAGE",{"url":95,"sources":96,"tags":97},"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33244.json",[79],[84],{"url":99,"sources":100,"tags":101},"https://github.com/remix-run/react-router/pull/14880",[78],[83],{"url":103,"sources":104,"tags":105},"https://github.com/remix-run/react-router/commit/ea28e66926460656815cee9b7f2dfaa872513a8c",[78],[83],{"url":107,"sources":108,"tags":109},"https://github.com/remix-run/react-router/blob/react-router%407.13.2/CHANGELOG.md#v7132",[78],[83],[],{"date":112,"score":67,"percentile":113},"2026-09-19",0.04121,[115,119,123,126,129,132,135,138,141,144,147,150,153,156,159,162,164,167,170,173,175,178,181,184,187,190,193,196,199,202,205,208,211,214,216,218,221,224,227,230,233,236,239,242,245,247,249,252,255,258,261,264,267,269,272,275,278,281,284,287,290,293,296,298,301,304,307,310,312,314,317,320,323,326,328,331,334,337,340,343,346,349,352,355,358,361,364,366,368,371],{"date":116,"score":117,"percentile":118},"2026-06-03",0.00029,0.08639,{"date":120,"score":121,"percentile":122},"2026-06-04",0.0003,0.0902,{"date":124,"score":121,"percentile":125},"2026-06-05",0.09061,{"date":127,"score":121,"percentile":128},"2026-06-06",0.09077,{"date":130,"score":121,"percentile":131},"2026-06-07",0.09057,{"date":133,"score":121,"percentile":134},"2026-06-08",0.0914,{"date":136,"score":121,"percentile":137},"2026-06-09",0.0917,{"date":139,"score":121,"percentile":140},"2026-06-10",0.0921,{"date":142,"score":121,"percentile":143},"2026-06-11",0.09255,{"date":145,"score":121,"percentile":146},"2026-06-12",0.09307,{"date":148,"score":121,"percentile":149},"2026-06-13",0.09308,{"date":151,"score":121,"percentile":152},"2026-06-14",0.09298,{"date":154,"score":67,"percentile":155},"2026-06-15",0.04004,{"date":157,"score":67,"percentile":158},"2026-06-16",0.04014,{"date":160,"score":67,"percentile":161},"2026-06-17",0.04029,{"date":163,"score":67,"percentile":161},"2026-06-18",{"date":165,"score":67,"percentile":166},"2026-06-19",0.04025,{"date":168,"score":67,"percentile":169},"2026-06-20",0.0402,{"date":171,"score":67,"percentile":172},"2026-06-21",0.04019,{"date":174,"score":67,"percentile":158},"2026-06-22",{"date":176,"score":67,"percentile":177},"2026-06-23",0.04042,{"date":179,"score":67,"percentile":180},"2026-06-24",0.04046,{"date":182,"score":67,"percentile":183},"2026-06-25",0.04054,{"date":185,"score":67,"percentile":186},"2026-06-26",0.04068,{"date":188,"score":67,"percentile":189},"2026-06-27",0.04066,{"date":191,"score":67,"percentile":192},"2026-06-28",0.04087,{"date":194,"score":67,"percentile":195},"2026-06-29",0.04085,{"date":197,"score":67,"percentile":198},"2026-06-30",0.04076,{"date":200,"score":67,"percentile":201},"2026-07-01",0.04083,{"date":203,"score":67,"percentile":204},"2026-07-02",0.04077,{"date":206,"score":67,"percentile":207},"2026-07-03",0.04069,{"date":209,"score":67,"percentile":210},"2026-07-04",0.04073,{"date":212,"score":67,"percentile":213},"2026-07-05",0.04071,{"date":215,"score":67,"percentile":207},"2026-07-06",{"date":217,"score":67,"percentile":201},"2026-07-07",{"date":219,"score":67,"percentile":220},"2026-07-08",0.04098,{"date":222,"score":67,"percentile":223},"2026-07-09",0.04115,{"date":225,"score":67,"percentile":226},"2026-07-10",0.04119,{"date":228,"score":67,"percentile":229},"2026-07-11",0.04117,{"date":231,"score":67,"percentile":232},"2026-07-12",0.04114,{"date":234,"score":67,"percentile":235},"2026-07-13",0.04112,{"date":237,"score":67,"percentile":238},"2026-07-14",0.04109,{"date":240,"score":67,"percentile":241},"2026-07-15",0.04113,{"date":243,"score":67,"percentile":244},"2026-07-16",0.04123,{"date":246,"score":67,"percentile":113},"2026-07-17",{"date":248,"score":67,"percentile":113},"2026-07-18",{"date":250,"score":67,"percentile":251},"2026-07-19",0.04116,{"date":253,"score":67,"percentile":254},"2026-07-20",0.0411,{"date":256,"score":67,"percentile":257},"2026-07-21",0.04144,{"date":259,"score":67,"percentile":260},"2026-07-22",0.04159,{"date":262,"score":67,"percentile":263},"2026-07-23",0.04148,{"date":265,"score":67,"percentile":266},"2026-07-24",0.04149,{"date":268,"score":67,"percentile":266},"2026-07-25",{"date":270,"score":67,"percentile":271},"2026-07-26",0.04145,{"date":273,"score":67,"percentile":274},"2026-07-27",0.04158,{"date":276,"score":67,"percentile":277},"2026-07-28",0.04155,{"date":279,"score":67,"percentile":280},"2026-07-29",0.04172,{"date":282,"score":67,"percentile":283},"2026-07-30",0.04204,{"date":285,"score":67,"percentile":286},"2026-07-31",0.0421,{"date":288,"score":67,"percentile":289},"2026-08-01",0.04201,{"date":291,"score":67,"percentile":292},"2026-08-02",0.04192,{"date":294,"score":67,"percentile":295},"2026-08-03",0.0419,{"date":297,"score":67,"percentile":292},"2026-08-04",{"date":299,"score":67,"percentile":300},"2026-08-05",0.04184,{"date":302,"score":67,"percentile":303},"2026-08-06",0.04175,{"date":305,"score":67,"percentile":306},"2026-08-07",0.04176,{"date":308,"score":67,"percentile":309},"2026-08-08",0.04174,{"date":311,"score":67,"percentile":306},"2026-08-09",{"date":313,"score":67,"percentile":300},"2026-08-10",{"date":315,"score":67,"percentile":316},"2026-08-11",0.04181,{"date":318,"score":67,"percentile":319},"2026-08-12",0.04191,{"date":321,"score":67,"percentile":322},"2026-08-13",0.04196,{"date":324,"score":67,"percentile":325},"2026-08-14",0.04219,{"date":327,"score":67,"percentile":286},"2026-08-15",{"date":329,"score":67,"percentile":330},"2026-08-16",0.04197,{"date":332,"score":67,"percentile":333},"2026-08-17",0.04221,{"date":335,"score":67,"percentile":336},"2026-08-18",0.04229,{"date":338,"score":67,"percentile":339},"2026-08-19",0.04227,{"date":341,"score":67,"percentile":342},"2026-08-20",0.04232,{"date":344,"score":67,"percentile":345},"2026-08-21",0.04223,{"date":347,"score":67,"percentile":348},"2026-08-22",0.04225,{"date":350,"score":67,"percentile":351},"2026-08-23",0.04205,{"date":353,"score":67,"percentile":354},"2026-08-24",0.0395,{"date":356,"score":67,"percentile":357},"2026-08-25",0.03972,{"date":359,"score":67,"percentile":360},"2026-08-26",0.03979,{"date":362,"score":67,"percentile":363},"2026-08-27",0.04037,{"date":365,"score":67,"percentile":158},"2026-08-28",{"date":367,"score":67,"percentile":161},"2026-08-29",{"date":369,"score":67,"percentile":370},"2026-08-30",0.04038,{"date":372,"score":67,"percentile":373},"2026-08-31",0.04039,[375,380,382,384],{"source":71,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":376,"cvss_v4_0":9},{"baseScore":69,"baseSeverity":377,"vectorString":72,"impactScore":378,"exploitabilityScore":379},"MEDIUM",4.5,5.9,{"source":77,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":381,"cvss_v4_0":9},{"baseScore":69,"baseSeverity":377,"vectorString":72,"impactScore":378,"exploitabilityScore":379},{"source":78,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":383,"cvss_v4_0":9},{"baseScore":69,"baseSeverity":9,"vectorString":72,"impactScore":378,"exploitabilityScore":379},{"source":79,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":385,"cvss_v4_0":9},{"baseScore":69,"baseSeverity":9,"vectorString":72,"impactScore":378,"exploitabilityScore":379},[387,397,401,413,419],{"ecosystem":388,"name":389,"vendor":390,"product":389,"cpe_part":9,"purl_type":391,"purl_namespace":390,"purl_name":389,"source":9,"versions":392},"Chainguard","airflow-2","chainguard","apk",[393],{"version":394,"is_range":395,"range_type":396,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",true,"ecosystem",{"ecosystem":388,"name":398,"vendor":390,"product":398,"cpe_part":9,"purl_type":391,"purl_namespace":390,"purl_name":398,"source":9,"versions":399},"airflow-core-2",[400],{"version":394,"is_range":395,"range_type":396,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":402,"name":403,"vendor":402,"product":403,"cpe_part":9,"purl_type":404,"purl_namespace":9,"purl_name":403,"source":9,"versions":405},"Npm","react-router","npm",[406],{"version":407,"is_range":395,"range_type":408,"version_start":409,"version_start_type":410,"version_end":411,"version_end_type":412,"fixed_in":9},"gte7_5_1_lt7_13_2","semver","7.5.1","including","7.13.2","excluding",{"ecosystem":9,"name":403,"vendor":414,"product":403,"cpe_part":415,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":416},"remix-run","a",[417],{"version":418,"is_range":395,"range_type":71,"version_start":409,"version_start_type":410,"version_end":411,"version_end_type":412,"fixed_in":9},">= 7.5.1, \u003C 7.13.2",{"ecosystem":9,"name":403,"vendor":420,"product":403,"cpe_part":415,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":421},"shopify",[422],{"version":423,"is_range":395,"range_type":424,"version_start":409,"version_start_type":410,"version_end":411,"version_end_type":412,"fixed_in":9},"gte7.5.1_lt7.13.2","cpe"]