[GHSA-f22v-gfqf-p8f3] React Router has stored XSS via unescaped Location header in prerendered redirect HTML

[HF-CYGG]

Updates

• References

Comments
Add the missing upstream fix commit for GHSA-f22v-gfqf-p8f3.

Commit ea28e66926460656815cee9b7f2dfaa872513a8c is the final merged commit for upstream PR #14880, "Escape locations in prerendered redirect HTML".

In packages/react-router-dev/vite/plugin.ts, the commit applies escapeHtml() to redirect locations before interpolating them into the generated HTML title, meta-refresh content, link, and visible redirect text. It also escapes the source path in both redirect-generation paths. These are the pre-rendered HTML outputs described by this advisory.

The changeset is for @react-router/dev, and the React Router 7.13.2 release changelog explicitly lists PR #14880 under that package. The official react-router@7.13.2 release tag contains the merged commit, matching the advisory's recorded patched release line.

Supporting sources:

• Upstream PR: Escape locations in prerendered redirect HTML remix-run/react-router#14880
• Release changelog: https://github.com/remix-run/react-router/blob/react-router%407.13.2/CHANGELOG.md#v7132
• Release ancestry: remix-run/react-router@ea28e66...react-router@7.13.2

The proposed advisory change only adds the merged fix commit reference. No changes to package attribution, version ranges, severity, CWE, or the advisory description are proposed.

[github]

Hi there @brophdawg11! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory