{"id":"CVE-2026-53668","summary":"React Router: Open redirect can lead to XSS","details":"React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.","aliases":["GHSA-jjmj-jmhj-qwj2"],"modified":"2026-08-12T03:51:21.553044920Z","published":"2026-07-27T21:42:17.641Z","related":["CGA-2hmm-c4xc-pff8"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53668.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-601","CWE-79"]},"references":[{"type":"WEB","url":"https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180"},{"type":"WEB","url":"https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53668.json"},{"type":"ADVISORY","url":"https://github.com/remix-run/react-router/security/advisories/GHSA-jjmj-jmhj-qwj2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53668"},{"type":"FIX","url":"https://github.com/remix-run/react-router/commit/3a5b5ad0e5cf9918c646509563f5c41a89226ff3"},{"type":"FIX","url":"https://github.com/remix-run/react-router/pull/14718"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/remix-run/react-router","events":[{"introduced":"26b5d4581fb2829dc7eaeaad413de4735173a6eb"},{"last_affected":"72973b6493d27014aa76a23a95e3ca186616c4fd"},{"introduced":"e75da95e16ecf625f4e3bbc864b1a0a5202052c2"},{"fixed":"5557ba3f848e52dfe400a47cc28256a51e13a150"},{"fixed":"3a5b5ad0e5cf9918c646509563f5c41a89226ff3"},{"fixed":"24283e93971e3e4f9f909c0bae63583f173fcd52"}],"database_specific":{"extracted_events":[{"introduced":"6.30.2"},{"last_affected":"6.30.4"},{"introduced":"7.9.6"},{"fixed":"7.13.0"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:*"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53668.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N"}]}