CVE-2026-53668

Summary

React Router: Open redirect leading to XSS

Severity

medium

CVSS

6.9

EPSS

0.3% (p27)

CWE

CWE-601

Also known as

GHSA-jjmj-jmhj-qwj2#react-router-dom

Published

2026-07-23

Updated

2026-07-23

Advisory details

Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors.

References

• https://github.com/advisories/GHSA-jjmj-jmhj-qwj2
• https://github.com/remix-run/react-router/security/advisories/GHSA-jjmj-jmhj-qwj2
• https://github.com/remix-run/react-router/pull/14718
• https://github.com/remix-run/react-router/commit/3a5b5ad0e5cf9918c646509563f5c41a89226ff3
• https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180
• https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0

Related advisories

• CVE-2026-108261 — critical · npm/tinacms
• CVE-2026-71428 — critical · PyPI/unstructured
• CVE-2026-54588 — critical · Packagist/poweradmin/poweradmin
• CVE-2026-54072 — critical · Go/github.com/authorizerdev/authorizer
• CVE-2026-101907 — high · npm/axios
• CVE-2026-53728 — high · npm/@medplum/core
• CVE-2026-54603 — high · RubyGems/oauth2
• GHSA-86j7-9j95-vpqj — high · npm/better-auth

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity