{"id":"CVE-2026-53668","summary":"React Router: Open redirect can lead to XSS","details":"React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.","aliases":["GHSA-jjmj-jmhj-qwj2"],"modified":"2026-07-29T03:47:09.564994583Z","published":"2026-07-27T21:42:17.641Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-601","CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53668.json"},"references":[{"type":"WEB","url":"https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180"},{"type":"WEB","url":"https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53668.json"},{"type":"ADVISORY","url":"https://github.com/remix-run/react-router/security/advisories/GHSA-jjmj-jmhj-qwj2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53668"},{"type":"FIX","url":"https://github.com/remix-run/react-router/commit/3a5b5ad0e5cf9918c646509563f5c41a89226ff3"},{"type":"FIX","url":"https://github.com/remix-run/react-router/pull/14718"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/remix-run/react-router","events":[{"introduced":"26b5d4581fb2829dc7eaeaad413de4735173a6eb"},{"last_affected":"72973b6493d27014aa76a23a95e3ca186616c4fd"},{"introduced":"e75da95e16ecf625f4e3bbc864b1a0a5202052c2"},{"fixed":"5557ba3f848e52dfe400a47cc28256a51e13a150"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"6.30.2"},{"last_affected":"6.30.4"},{"introduced":"7.9.6"},{"fixed":"7.13.0"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53668.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N"}]}