React Router EUVD-2026-33986

Framework Mode must be in use with pre-rendering explicitly enabled - applications using Declarative Mode (BrowserRouter) or Data Mode (createBrowserRouter/RouterProvider) are not affected regardless of version. The redirect location must originate from an untrusted or attacker-influenced source (e.g., a user-supplied redirect parameter that is not validated server-side). The CVSS vector PR:L confirms that low-privilege authentication is required - the attacker cannot exploit this anonymously. The CVSS UI:R condition means a victim must navigate to the affected pre-rendered page. These combined prerequisites - specific framework mode, attacker-controlled redirect input, authenticated access, and victim interaction - significantly constrain realistic exploitation beyond the raw CVSS score.

CVSS 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The network attack vector and low complexity indicate the vulnerability is remotely reachable without technical sophistication, but two constraints materially reduce real-world risk: PR:L requires the attacker to hold some authenticated or low-privileged role capable of influencing redirect locations, and UI:R requires a victim to visit the affected pre-rendered page. The Changed Scope (S:C) elevates the score because successful XSS can reach browser-stored credentials or session tokens beyond the vulnerable origin. EPSS data was not provided in available intelligence, so probabilistic exploitation likelihood cannot be quantified. No KEV listing and no public POC exist, suggesting this has not been observed exploited in the wild. The deployment constraint - Framework Mode with pre-rendering specifically - further narrows the realistic attack surface. Overall, this is a genuine medium-severity concern for teams using the specific affected configuration, but not an emergency priority for the broader React ecosystem.

An authenticated low-privilege user (or an attacker who has compromised such an account) submits a crafted redirect URL containing a JavaScript payload as the Location header value through an application endpoint that accepts user-influenced redirects. When the React Router pre-renderer processes this redirect during static site generation, the unsanitized Location value is embedded into the resulting HTML file. A victim who subsequently loads the pre-rendered page triggers execution of the injected script in their browser, potentially exposing session tokens or enabling account takeover. No public exploit code has been identified at time of analysis.