{"id":"GHSA-h8fp-f39c-q6mh","summary":"React Router: RSCErrorHandler Missing Protocol Validation (XSS)","details":"This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62.  React Router was alerted of a code path in the (unstable) RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect targets\n\n\u003e [!NOTE]\n\u003e This only affects your application if you are using the unstable RSC APIs","aliases":["CVE-2026-53667"],"modified":"2026-09-10T03:50:52.323492500Z","published":"2026-07-23T19:35:57Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-07-23T19:35:57Z","nvd_published_at":null,"cwe_ids":["CWE-79"]},"references":[{"type":"WEB","url":"https://github.com/remix-run/react-router/security/advisories/GHSA-h8fp-f39c-q6mh"},{"type":"WEB","url":"https://github.com/remix-run/react-router/pull/15177"},{"type":"WEB","url":"https://github.com/remix-run/react-router/commit/ce596e823f0d7b883a433af1d5a839a8b9fe0242"},{"type":"PACKAGE","url":"https://github.com/remix-run/react-router"},{"type":"WEB","url":"https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180"},{"type":"WEB","url":"https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0"}],"affected":[{"package":{"name":"react-router","ecosystem":"npm","purl":"pkg:npm/react-router"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.11.0"},{"fixed":"7.18.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-h8fp-f39c-q6mh/GHSA-h8fp-f39c-q6mh.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N"}]}