CVE-2026-53668

Analyzed Analyzed - Analysis Complete

React Router Open Redirect XSS Vulnerability

Publication date: 2026-07-27

Last updated on: 2026-08-03

Assigner: GitHub, Inc.

Description

React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-08-03

Generated

2026-08-17

AI Q&A

2026-07-28

EPSS Evaluated

2026-08-15

NVD

CVE-2026-53668

Affected Vendors & Products

Vendor	Product	Version / Range
shopify	react-router	From 6.30.2 (inc) to 6.30.4 (inc)
shopify	react-router	From 7.9.6 (inc) to 7.13.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability affects React Router versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0. It allows open redirects that can be exploited for XSS attacks. An attacker could create a malicious link to redirect users to an unexpected site or inject malicious scripts.

Detection Guidance

This vulnerability is specific to React Router versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0. To detect it, check your React Router version in your project's package.json or by running npm list react-router in your project directory. If the version falls within the vulnerable range, update to version 7.13.0 or later.

Impact Analysis

If your application uses a vulnerable React Router version, users could be redirected to malicious sites or have scripts executed in their browsers. This may lead to data theft, session hijacking, or other security breaches.

Compliance Impact

This vulnerability could lead to unauthorized data access or exposure, violating GDPR's data protection requirements or HIPAA's security rules for protected health information. Non-compliance may result in legal penalties.

Mitigation Strategies

Upgrade React Router to version 7.13.0 or later to address the XSS vulnerability in open redirect functionality.

Hi! I’m here to help you understand CVE-2026-53668. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70