{"id":"CVE-2026-53668","aliases":["CLSA-2026-1787668126","CLSA-2026-1789029484","CLSA-2026-1792253400","CLSA-2026-1792253407","CLSA-2026-1792269432","CLSA-2026-1792840526","EUVD-2026-49633","GHSA-jjmj-jmhj-qwj2"],"status":"published","title":"React Router: Open redirect can lead to XSS","description":"React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.","severity":{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00341,"percentile":0.27867,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601","CWE-79"],"published":"2026-07-23T19:36:31Z","modified":"2026-11-02T19:59:01Z","fixes":[{"ecosystem":"npm","package":"react-router","fixed_in":["7.13.0"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"react-router-dom","fixed_in":["6.30.6"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"react-router-dom","fixed_in":["6.30.4-tuxcare.1","6.30.3-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.9.6"},{"last_affected":"7.12.0"},{"fixed":"7.13.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"react-router-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.30.2"},{"last_affected":"6.30.5"},{"fixed":"6.30.6"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.30.4-tuxcare.0"},{"fixed":"6.30.4-tuxcare.1"}]}],"versions":["6.30.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router-dom-v5-compat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.30.4-tuxcare.0"},{"fixed":"6.30.4-tuxcare.1"}]}],"versions":["6.30.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.30.3-tuxcare.0"},{"fixed":"6.30.3-tuxcare.1"}]}],"versions":["6.30.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router-dom-v5-compat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.30.3-tuxcare.0"},{"fixed":"6.30.3-tuxcare.1"}]}],"versions":["6.30.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.30.4-tuxcare.0"},{"fixed":"6.30.4-tuxcare.1"}]}],"versions":["6.30.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.30.3-tuxcare.0"},{"fixed":"6.30.3-tuxcare.1"}]}],"versions":["6.30.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-router-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.30.3-tuxcare.0"},{"fixed":"6.30.3-tuxcare.1"}]}],"versions":["6.30.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@remix-run/router","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.23.3-tuxcare.0"},{"fixed":"1.23.3-tuxcare.1"}]}],"versions":["1.23.3"],"bundled":3},{"source":"osv","ecosystem":"npm","package":"react-router-dom","ranges":[{"type":"SEMVER","events":[{"introduced":"6.30.2"},{"fixed":"6.30.6"}]}]},{"source":"osv","ecosystem":"npm","package":"react-router","ranges":[{"type":"SEMVER","events":[{"introduced":"7.9.6"},{"fixed":"7.13.0"}]}]}],"products":[{"vendor":"@tanstack","product":"react-router"},{"vendor":"remix-run","product":"react-router"},{"vendor":"shopify","product":"react-router"}],"references":[{"url":"https://github.com/remix-run/react-router/security/advisories/GHSA-jjmj-jmhj-qwj2","tags":["x_refsource_CONFIRM","Third Party Advisory","advisory","web"]},{"url":"https://github.com/remix-run/react-router/pull/14718","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/remix-run/react-router/commit/3a5b5ad0e5cf9918c646509563f5c41a89226ff3","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53668","tags":["advisory"]},{"url":"https://github.com/remix-run/react-router/blob/v6/CHANGELOG.md#v6306","tags":["web"]},{"url":"https://github.com/remix-run/react-router/releases/tag/react-router@6.30.6","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jjmj-jmhj-qwj2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53668.json","tags":["advisory"]},{"url":"https://github.com/remix-run/react-router","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-53668","title":"React Router: Open redirect can lead to XSS","description":"React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.","status":"published","published":"2026-07-27T21:42:17.641Z","modified":"2026-07-28T13:44:11.335Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-601","CWE-79"],"updated_at":"2026-11-02T14:19:59.761005Z"}],"euvd":[{"id":"EUVD-2026-49633","description":"React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.","status":"published","published":"2026-07-27T21:42:17Z","modified":"2026-07-28T13:44:11Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:31.827348Z"}],"ghsa":[{"id":"GHSA-jjmj-jmhj-qwj2","title":"React Router: Open redirect leading to XSS","description":"Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors.","status":"published","published":"2026-07-23T19:36:31Z","modified":"2026-09-08T15:09:29Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-79","CWE-601"],"updated_at":"2026-11-02T14:41:13.477974Z"}],"nvd":[{"id":"CVE-2026-53668","description":"React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.","status":"published","published":"2026-07-27T22:17:31.237Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79","CWE-601"],"updated_at":"2026-11-02T14:12:33.249634Z"}],"osv":[{"id":"CVE-2026-53668","title":"React Router: Open redirect can lead to XSS","description":"React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.","status":"published","published":"2026-07-27T21:42:17.641Z","modified":"2026-10-28T02:30:58.941371964Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-601","CWE-79"],"updated_at":"2026-11-02T15:45:08.132336Z"},{"id":"GHSA-jjmj-jmhj-qwj2","title":"React Router: Open redirect leading to XSS","description":"Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors.","status":"published","published":"2026-07-23T19:36:31Z","modified":"2026-09-08T15:15:05.351463216Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-601","CWE-79"],"updated_at":"2026-11-02T15:46:50.687609Z"},{"id":"CLSA-2026-1787668126","title":"TuxCare security update for 2 packages (3 CVEs)","description":"TuxCare rebuilt 2 packages to address 3 CVEs. Fixed in 6.30.4-tuxcare.1.","status":"published","published":"2026-08-25T14:28:46Z","modified":"2026-10-17T19:01:07.735863781Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1789029484","title":"TuxCare security update for 2 packages (2 CVEs)","description":"TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 6.30.3-tuxcare.1.","status":"published","published":"2026-09-10T08:38:04Z","modified":"2026-10-23T19:15:06.280906501Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1792253400","title":"TuxCare security update for react-router-dom (1 CVE)","description":"TuxCare rebuilt react-router-dom to address 1 CVE. Fixed in 6.30.4-tuxcare.1.","status":"published","published":"2026-10-17T16:09:56Z","modified":"2026-11-02T19:59:01.258966812Z","updated_at":"2026-11-02T20:21:30.928169Z"},{"id":"CLSA-2026-1792253407","title":"TuxCare security update for react-router-dom (1 CVE)","description":"TuxCare rebuilt react-router-dom to address 1 CVE. Fixed in 6.30.3-tuxcare.1.","status":"published","published":"2026-10-17T16:10:04Z","modified":"2026-11-02T19:58:41.836027618Z","updated_at":"2026-11-02T20:22:55.181884Z"},{"id":"CLSA-2026-1792269432","title":"TuxCare security update for react-router-native (2 CVEs)","description":"TuxCare rebuilt react-router-native to address 2 CVEs. Fixed in 6.30.3-tuxcare.1.","status":"published","published":"2026-10-17T20:37:12Z","modified":"2026-10-18T01:30:33.187607916Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792840526","title":"TuxCare security update for @remix-run/router (3 CVEs)","description":"TuxCare rebuilt @remix-run/router to address 3 CVEs. Fixed in 1.23.3-tuxcare.1.","status":"published","published":"2026-10-24T11:15:26Z","modified":"2026-10-24T13:30:02.662597028Z","updated_at":"2026-11-02T15:43:54.981307Z"}]}}