CVE-2026-53668
React Router: Open redirect can lead to XSS
React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
React Router: Open redirect can lead to XSS
React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.
- Record
CVE-2026-53668- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-601, CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-49633
React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.
- Record
EUVD-2026-49633- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jjmj-jmhj-qwj2
React Router: Open redirect leading to XSS
Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors.
- Record
GHSA-jjmj-jmhj-qwj2- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79, CWE-601
- Updated
- 2026-11-02
NVD
React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.
- Record
CVE-2026-53668- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79, CWE-601
- Updated
- 2026-11-02
OSV
React Router: Open redirect can lead to XSS
React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.
- Record
CVE-2026-53668- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-601, CWE-79
- Updated
- 2026-11-02
OSVGHSA-jjmj-jmhj-qwj2
React Router: Open redirect leading to XSS
Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors.
- Record
GHSA-jjmj-jmhj-qwj2- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-601, CWE-79
- Updated
- 2026-11-02
Show 7 moreShow less
OSVCLSA-2026-1787668126 No score
TuxCare security update for 2 packages (3 CVEs)
TuxCare rebuilt 2 packages to address 3 CVEs. Fixed in 6.30.4-tuxcare.1.
- Record
CLSA-2026-1787668126- Updated
- 2026-11-02
OSVCLSA-2026-1789029484 No score
TuxCare security update for 2 packages (2 CVEs)
TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 6.30.3-tuxcare.1.
- Record
CLSA-2026-1789029484- Updated
- 2026-11-02
OSVCLSA-2026-1792253400 No score
TuxCare security update for react-router-dom (1 CVE)
TuxCare rebuilt react-router-dom to address 1 CVE. Fixed in 6.30.4-tuxcare.1.
- Record
CLSA-2026-1792253400- Updated
- 2026-11-02
OSVCLSA-2026-1792253407 No score
TuxCare security update for react-router-dom (1 CVE)
TuxCare rebuilt react-router-dom to address 1 CVE. Fixed in 6.30.3-tuxcare.1.
- Record
CLSA-2026-1792253407- Updated
- 2026-11-02
OSVCLSA-2026-1792269432 No score
TuxCare security update for react-router-native (2 CVEs)
TuxCare rebuilt react-router-native to address 2 CVEs. Fixed in 6.30.3-tuxcare.1.
- Record
CLSA-2026-1792269432- Updated
- 2026-11-02
OSVCLSA-2026-1792840526 No score
TuxCare security update for @remix-run/router (3 CVEs)
TuxCare rebuilt @remix-run/router to address 3 CVEs. Fixed in 1.23.3-tuxcare.1.
- Record
CLSA-2026-1792840526- Updated
- 2026-11-02
OSVCLSA-2026-1792840748 No score
TuxCare security update for @remix-run/router (4 CVEs)
TuxCare rebuilt @remix-run/router to address 4 CVEs. Fixed in 1.23.2-tuxcare.1.
- Record
CLSA-2026-1792840748- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
react-routernpm |
7.9.6 to 7.12.0 | 7.13.0 |
react-router-domnpm |
6.30.2 to 6.30.5 | 6.30.6 |
react-routerTuxCare:npm From an advisory covering 3 CVEs |
6.30.4-tuxcare.0 up to 6.30.4-tuxcare.1, plus listed versions 6.30.4 |
6.30.4-tuxcare.1 |
react-router-dom-v5-compatTuxCare:npm From an advisory covering 3 CVEs |
6.30.4-tuxcare.0 up to 6.30.4-tuxcare.1, plus listed versions 6.30.4 |
6.30.4-tuxcare.1 |
react-routerTuxCare:npm From an advisory covering 2 CVEs |
6.30.3-tuxcare.0 up to 6.30.3-tuxcare.1, plus listed versions 6.30.3 |
6.30.3-tuxcare.1 |
react-router-dom-v5-compatTuxCare:npm From an advisory covering 2 CVEs |
6.30.3-tuxcare.0 up to 6.30.3-tuxcare.1, plus listed versions 6.30.3 |
6.30.3-tuxcare.1 |
react-router-domTuxCare:npm |
6.30.4-tuxcare.0 up to 6.30.4-tuxcare.1, plus listed versions 6.30.4 |
6.30.4-tuxcare.1 |
react-router-domTuxCare:npm |
6.30.3-tuxcare.0 up to 6.30.3-tuxcare.1, plus listed versions 6.30.3 |
6.30.3-tuxcare.1 |
react-router-nativeTuxCare:npm From an advisory covering 2 CVEs |
6.30.3-tuxcare.0 up to 6.30.3-tuxcare.1, plus listed versions 6.30.3 |
6.30.3-tuxcare.1 |
@remix-run/routerTuxCare:npm From an advisory covering 3 CVEs |
1.23.3-tuxcare.0 up to 1.23.3-tuxcare.1, plus listed versions 1.23.3 |
1.23.3-tuxcare.1 |
@remix-run/routerTuxCare:npm From an advisory covering 4 CVEs |
1.23.2-tuxcare.0 up to 1.23.2-tuxcare.1, plus listed versions 1.23.2 |
1.23.2-tuxcare.1 |
react-router-domnpm |
6.30.2 up to 6.30.6 | 6.30.6 |
react-routernpm |
7.9.6 up to 7.13.0 | 7.13.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-53668 is a medium vulnerability (CVSS 6.9) in @tanstack React-router, published July 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in react-router 7.13.0.
References
github.com/remix-run/react-router/security/advisories/GHSA-jjmj-jmhj-qwj2
nvd.nist.gov/vuln/detail/CVE-2026-53668