Security Bulletin: Security vulnerability in JavaScript affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak

Summary A security vulnerability in JavaScript affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak. JavaScript is used by IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak as part of its deployment. This bulletin identifies the fix...

@accounter/client (>=0.0.5-alpha-20250418160359-9049f823132a66e39d4d7a239567055e4e03266b, <=0.0.11-alpha-20260328161521-814e4fc7c5b0b6b919590e293c0fac45b7c2513d), @boxyhq/react-ui (>=3.4.1, <=3.5.3) +191 more potentially affected by CVE-2026-33244 via react-router (>=7.5.1, <=7.13.1-pre.0)

react-router NPM version =7.5.1, =0.0.5-alpha-20250418160359-9049f823132a66e39d4d7a239567055e4e03266b, =3.4.1, =0.2.3, =1.0.1-MON-198407-add-selinux-sudo-check.0, =0.0.1, =1.0.3, =0.1.0, =3.3.7, =3.0.0-alpha.2, =3.2.0-beta.0, =15.9.0, =0.1.9, =0.0.1-dev.8, =0.0.2-1 and more Source cves:...

@cyberskill/cyber-editor (>=3.8.8, <=3.9.0), @shopify/dev-mcp (>=1.7.2, <=1.8.0) +2 more potentially affected by CVE-2026-33244 via @react-router/dev (>=7.6.0, <=7.13.1)

@react-router/dev NPM version =7.6.0, =3.8.8, =1.7.2, =0.0.2, =0.0.19 - deploy.sh 3.0.0 Source cves: CVE-2026-33244 Source advisory: SNYK:JS-REACTROUTERDEV-17137488...

CVE-2026-33244 React Router has stored XSS via unescaped Location header in prerendered redirect HTML

React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the HTTP Location header value can permit Cross-Site Scripting XSS in the statically generated HTML files if the redirect location comes from an...