CVE-2026-53669

Analyzed Analyzed - Analysis Complete

Open Redirect in React Router

Publication date: 2026-07-27

Last updated on: 2026-08-03

Assigner: GitHub, Inc.

Description

React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in <Link> and useNavigate. This issue is a follow up to CVE-2025-68470 and has been fixed in version 7.18.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-08-03

Generated

2026-08-17

AI Q&A

2026-07-28

EPSS Evaluated

2026-08-16

NVD

CVE-2026-53669

Affected Vendors & Products

Vendor	Product	Version / Range
shopify	react-router	From 6.0.0 (inc) to 7.18.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

React Router versions 6.0.0 through 7.17.0 are vulnerable to an Open Redirect issue. This occurs because backslashes in <Link> components or useNavigate can be manipulated to redirect users to unintended URLs.

Detection Guidance

To detect this vulnerability, check if your React Router version is between 6.0.0 and 7.17.0. Run commands like 'npm list react-router' or 'yarn list react-router' to verify the installed version.

Impact Analysis

An attacker could trick users into visiting malicious sites by exploiting this vulnerability. This may lead to phishing attacks, credential theft, or malware distribution through deceptive links.

Compliance Impact

This vulnerability involves open redirect through backslashes in React Router, which could allow attackers to redirect users to malicious sites. While not directly impacting GDPR or HIPAA compliance, such vulnerabilities may lead to unauthorized data exposure or phishing attacks, potentially violating data protection requirements under these regulations.

Mitigation Strategies

Upgrade React Router to version 7.18.0 or later immediately. Use commands like 'npm update react-router' or 'yarn upgrade react-router@latest' to apply the fix.

Hi! I’m here to help you understand CVE-2026-53669. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70