React Router: Open redirect can lead to XSS
Summary
| CVE | CVE-2026-53668 |
|---|---|
| State | PUBLISHED |
| Assigner | GitHub_M |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-07-27 22:17:31 UTC |
| Updated | 2026-08-03 14:13:34 UTC |
| Description | React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0. |
Risk And Classification
Primary CVSS: v3.1 6.9 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
EPSS: 0.003370000 probability, percentile 0.262240000 (date 2026-08-04)
Problem Types: CWE-79 | CWE-601 | CWE-601 CWE-601: URL Redirection to Untrusted Site ('Open Redirect') | CWE-79 CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 6.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N |
| 3.1 | CNA | DECLARED | 6.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
NoneUser Interaction
RequiredScope
ChangedConfidentiality
HighIntegrity
LowAvailability
NoneCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Shopify | React-router | All | All | All | All |
| Application | Shopify | React-router | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Remix-run | React-router | affected >= 6.30.2, <= 6.30.4 | Not specified |
| CNA | Remix-run | React-router | affected >= 7.9.6, < 7.13.0 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/remix-run/react-router/pull/14718 | [email protected] | github.com | Issue Tracking, Patch |
| github.com/remix-run/react-router/security/advisories/GHSA-jjmj-jmhj-qwj2 | [email protected] | github.com | Third Party Advisory |
| github.com/remix-run/react-router/blob/main/CHANGELOG.md | [email protected] | github.com | Release Notes |
| github.com/remix-run/react-router/releases/tag/[email protected] | [email protected] | github.com | Release Notes |
| github.com/remix-run/react-router/commit/3a5b5ad0e5cf9918c646509563f5c41... | [email protected] | github.com | Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.