Vulnerability Details CVE-2026-53668
React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 26.1%
CVSS Severity
CVSS v3 Score 6.9
References
- https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180
- https://github.com/remix-run/react-router/commit/3a5b5ad0e5cf9918c646509563f5c41a89226ff3
- https://github.com/remix-run/react-router/pull/14718
- https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0
- https://github.com/remix-run/react-router/security/advisories/GHSA-jjmj-jmhj-qwj2
Products affected by CVE-2026-53668
-
cpe:2.3:a:shopify:react-router:6.30.2
-
cpe:2.3:a:shopify:react-router:6.30.3
-
cpe:2.3:a:shopify:react-router:6.30.4