React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the HTTP `Location` header value can permit Cross-Site Scripting (XSS) in the statically generated HTML files if the redirect location comes from an untrusted source. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.13.2.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3714-1 advisory.

    prometheus-postgres_exporter:

    - CVE-2022-21698: Replace github.com/prometheus/client_golang with version 1.11.1 and prevent validation     bypass       and privilege escalation (bsc#1248699)

    golang-github-prometheus-alertmanager:

    - CVE-2026-39821: Fix validation bypass and privilege escalation by  updating golang.org/x/net to version     0.55.0 (bsc#1266615)

    golang-github-prometheus-prometheus was updated from version 3.5.3 to 3.5.4:

    Security fixes:

    - CVE-2026-39882: Fix reading unbounded HTTP response bodies by bumping OpenTelemetry to 1.43.0     (bsc#1274221)
    - CVE-2026-33244: Fixed improper neutralization of the HTTP Location header value in react-router     (bsc#1267416)
    - CVE-2026-13149: Prevent potential DoS by bumping brace-expansion to version 5.0.7 (bsc#1269917)
    - CVE-2026-33814: Fixed infinite loop in HTTP/2 transport (bsc#1265827)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-     rendering enabled, improper neutralization of the HTTP `Location` header value can permit Cross-Site     Scripting (XSS) in the statically generated HTML files if the redirect location comes from an untrusted     source. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode     (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.13.2. (CVE-2026-33244)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-
    rendering enabled, improper neutralization of the HTTP `Location` header value can permit Cross-Site
    Scripting (XSS) in the statically generated HTML files if the redirect location comes from an untrusted
    source. This does not impact applications using Declarative Mode (`<BrowserRouter>`) or Data Mode
    (`createBrowserRouter/<RouterProvider>`). This is patched in version 7.13.2. (CVE-2026-33244)

ID	Name	Product	Family	Type	Severity
339763	SUSE SLES15: golang-github-prometheus-alertmanager / etc (SUSE-SU-2026:3714-1)	Nessus	SuSE Local Security Checks	Local	high
321709	Linux Distros Unpatched Vulnerability : CVE-2026-33244	Nessus	Misc.	Local	medium
442607	SCA: security update for react-router (GHSA-f22v-gfqf-p8f3)	Tenable Cloud Security	SCA Checks	Local	medium
442607	SCA: security update for react-router (GHSA-f22v-gfqf-p8f3)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-33244

medium

Tenable Plugins

high

medium

medium

medium