This vulnerability in React Router allows attackers to spoof pre-rendered data by manipulating the X-React-Router-Prerender-Data HTTP header. This can lead to cache poisoning and arbitrary content injection within the affected application, specifically Red Hat OpenShift AI 2.23.0. The issue is classified under CWE-345 (Insufficient Verification of Data Authenticity). Red Hat rates the severity as moderate due to the impact being limited to data integrity at the application layer, without affecting system availability. Currently, no mitigation or patch fully satisfying Red Hat's standards is available, and users should monitor Red Hat advisories for updates.

The vulnerability enables arbitrary content injection through cache poisoning at the application layer, potentially compromising data integrity. It does not affect system availability or confidentiality. There are no known exploits in the wild. The impact is confined to the React Router framework used within Red Hat OpenShift AI, affecting how pre-rendered data is handled and verified.

Red Hat currently does not provide a mitigation or patch that meets their criteria for ease of use, applicability, or stability. Users should follow the official Red Hat OpenShift AI upgrade documentation when updates become available. Monitoring Red Hat advisories and applying updates promptly once released is recommended.