Description
React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the HTTP `Location` header value can permit Cross-Site Scripting (XSS) in the statically generated HTML files if the redirect location comes from an untrusted source. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.13.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| remix-run | react-router | >= 7.5.1, < 7.13.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | golang-github-prometheus-alertmanager | 0.28.1-150100.4.34.1 | SUSE-SU-2026:3714-1 |
| SLES 15 SP7 | golang-github-prometheus-prometheus | 3.5.4-150100.4.37.2 | SUSE-SU-2026:3714-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-alertmanager | 0.28.1-150002.4.14.1 | SUSE-SU-2026:3713-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-prometheus | 3.5.4-150002.3.16.1 | SUSE-SU-2026:3713-1 |
| SUSE Multi Linux Manager Tools SLE-15 | grafana | 12.4.5-150002.4.24.1 | SUSE-SU-2026:3713-1 |
| SUSE Manager Client Tools 15 | golang-github-prometheus-alertmanager | 0.28.1-150100.4.34.1 | SUSE-SU-2026:3714-1 |
| SUSE Manager Client Tools 15 | golang-github-prometheus-prometheus | 3.5.4-150000.3.75.1 | SUSE-SU-2026:3714-1 |
| SUSE Manager Client Tools 15 | grafana | 12.4.5-150000.1.98.1 | SUSE-SU-2026:3714-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | react-router | >= 7.5.1, < 7.13.2 | 7.13.2 | GHSA-f22v-gfqf-p8f3 |
Advisories 2
- SUSE-SU-2026:3714-1 Security update for Multi-Linux Manager Monitoring stack SUSE / openSUSE Security Updates · Nov 10, 2026
- SUSE-SU-2026:3713-1 Security update for Multi-Linux Manager Client Tools - Monitoring stack SUSE / openSUSE Security Updates · Aug 24, 2026