The vulnerability arises when Remix's React Router, in Framework Mode with pre‑rendering enabled, fails to neutralise the value of the HTTP Location header. If the redirect target originates from an untrusted source, the unescaped value is embedded into the statically generated HTML file, leading to a stored cross‑site scripting flaw. An attacker could deliver malicious JavaScript that executes in the victim's browser whenever the affected static page is loaded. This flaw is classified under CWE‑79.

Vulnerable versions of remix‑run react‑router – specifically 7.5.1 through 7.13.1 – are impacted. The issue is resolved in 7.13.2 and later releases.

The CVSS score is 5.4, indicating moderate severity. The EPSS score is not available, and the flaw is not listed in CISA KEV. Exploitation requires that the attacker can influence the Location header of a prerendered redirect, which then becomes reflected in the static HTML served to users. Although the attack would not grant arbitrary code execution on the server, the reflected script would run with the privileges of the page context, potentially allowing data theft or session hijacking. The risk is therefore limited to client‑side impact but remains significant for sites that trust user‑generated redirects.