CVE-2026-53668

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53668
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53668.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53668
Aliases
Downstream
Published
2026-07-27T21:42:17.641Z
Modified
2026-07-28T04:02:55.628008950Z
Severity
  • 6.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N CVSS Calculator
Summary
React Router: Open redirect can lead to XSS
Details

React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53668.json",
    "cwe_ids": [
        "CWE-601",
        "CWE-79"
    ]
}
References

Affected packages

Git / github.com/remix-run/react-router

Affected ranges

Type
GIT
Repo
https://github.com/remix-run/react-router
Events
Introduced
26b5d4581fb2829dc7eaeaad413de4735173a6eb
Last affected
72973b6493d27014aa76a23a95e3ca186616c4fd
Introduced
e75da95e16ecf625f4e3bbc864b1a0a5202052c2
Fixed
5557ba3f848e52dfe400a47cc28256a51e13a150
Database specific 
{
    "extracted_events": [
        {
            "introduced": "6.30.2"
        },
        {
            "last_affected": "6.30.4"
        },
        {
            "introduced": "7.9.6"
        },
        {
            "fixed": "7.13.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53668.json"