Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-27T21:42:17 react-router: react-router-dom: React Router: Cross-Site Scripting (XSS) via open redirects 6.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N CWE-601

React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.

A flaw was found in React Router. Applications using React Router that allow open redirects are vulnerable to Cross-Site Scripting (XSS). A remote attacker could craft a malicious link that, when clicked by a user, redirects them to an unexpected external site or exploits an XSS vulnerability, potentially leading to information disclosure or unauthorized actions.

React Router (npm packages react-router and react-router-dom) versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0 contain an open redirect flaw. Applications that use React Router's navigation APIs (for example Navigate, redirect(), or loader/action responses) to redirect users to a URL derived from untrusted input, without validating that the target is an allow-listed internal or trusted destination, can be made to redirect a victim to an attacker-controlled site. In addition to the redirect itself, a crafted target URL can be used to achieve Cross-Site Scripting (XSS) against the vulnerable application, potentially exposing session data or allowing unauthorized actions in the context of the redirecting origin. This issue is fixed upstream in react-router/react-router-dom 7.13.0. This flaw is only reachable in Red Hat products that both bundle an affected version of react-router/react-router-dom in a web console or UI component AND implement an open redirect pattern (redirecting to a caller-supplied or otherwise untrusted URL) in that component's own routing code. Simply bundling react-router as a dependency does not by itself make a product exploitable; each console/UI must be independently assessed by its owning component team for whether it constructs redirects from untrusted input. Red Hat's CVSS score (6.9, AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N) matches the upstream/CVE.org self-assigned score exactly, so no Red Hat-specific re-scoring was applied. For comparison, a related but distinct prior React Router open-redirect-to-XSS flaw (CVE-2026-22029) was scored higher by Red Hat (8.0, Important) with Integrity High rather than Low; that difference is consistent with the upstream advisories describing different underlying primitives, and Red Hat's score here mirrors the vendor's own (lower) assessment of this specific issue's integrity impact. There is no mitigation available other than upgrading to react-router/react-router-dom 7.13.0 or later once the fix is packaged in the affected Red Hat products. As a defense-in-depth measure independent of this specific flaw, applications should always validate redirect targets against an allow-list of internal/trusted destinations before passing them to React Router's navigation or redirect APIs, rather than redirecting directly to caller-supplied URLs. A-MQ Interconnect 1 Not affected qpid-dispatch Cryostat 4 Not affected cryostat-openshift-console-plugin-npm Cryostat 4 Fix deferred grafana-infinity-datasource-npm Cryostat 4 Not affected react-router Cryostat 4 Fix deferred react-router-dom Exploit Intelligence Not affected exploit-intelligence-tech-preview/agent-client-rhel9 Gatekeeper 3 Not affected gatekeeper/gatekeeper-rhel9 Migration Toolkit for Applications 8 Not affected mta/mta-ui-rhel8 Migration Toolkit for Applications 8 Not affected mta/mta-ui-rhel9 Migration Toolkit for Containers Not affected rhmtc/openshift-migration-ui-rhel8 Migration Toolkit for Virtualization Fix deferred migration-toolkit-virtualization/mtv-console-plugin-rhel9 Multicluster Engine for Kubernetes Fix deferred multicluster-engine/console-mce-rhel9 Network Observability Operator Not affected network-observability/network-observability-console-plugin-pf4-rhel9 Network Observability Operator Not affected network-observability/network-observability-console-plugin-pf5-rhel9 Network Observability Operator Not affected network-observability/network-observability-console-plugin-rhel9 Node HealthCheck Operator Not affected workload-availability/node-healthcheck-must-gather-rhel9 Node HealthCheck Operator Not affected workload-availability/node-healthcheck-operator-bundle Node HealthCheck Operator Not affected workload-availability/node-healthcheck-rhel9-operator OpenShift Lightspeed Not affected openshift-lightspeed/lightspeed-agentic-console-rhel9 OpenShift Lightspeed Fix deferred openshift-lightspeed/lightspeed-console-plugin-419-rhel9 OpenShift Lightspeed Fix deferred openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 OpenShift Lightspeed Fix deferred openshift-lightspeed/lightspeed-console-plugin-rhel9 OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-console-plugin-pf5-rhel9 OpenShift Pipelines Not affected openshift-pipelines/pipelines-console-plugin-rhel8 OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-console-plugin-rhel9 OpenShift Pipelines Not affected openshift-pipelines/pipelines-hub-ui-rhel8 OpenShift Pipelines Fix deferred openshift-pipelines/pipelines-hub-ui-rhel9 OpenShift Service Mesh 3 Not affected openshift-service-mesh/kiali-operator-bundle OpenShift Service Mesh 3 Fix deferred openshift-service-mesh/kiali-ossmc-rhel9 OpenShift Service Mesh 3 Fix deferred openshift-service-mesh/kiali-rhel9 OpenShift Service Mesh 3 Not affected openshift-service-mesh/kiali-rhel9-operator Red Hat Advanced Cluster Management for Kubernetes 2 Fix deferred rhacm2/console-rhel9 Red Hat Advanced Cluster Security 4 Out of support scope advanced-cluster-security/rhacs-main-rhel8 Red Hat Advanced Cluster Security 4 Fix deferred advanced-cluster-security/rhacs-main-rhel9 Red Hat AMQ Broker 7 Not affected react-router Red Hat AMQ Broker 7 Not affected react-router-dom Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-26/gateway-rhel9 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-27/gateway-rhel9 Red Hat Ansible Automation Platform 2 Not affected ansible-on-clouds/aoc-azure-aap-installer-rhel9 Red Hat Ansible Automation Platform 2 Not affected automation-controller Red Hat Ansible Automation Platform 2 Not affected automation-eda-controller Red Hat Ansible Automation Platform 2 Not affected automation-gateway Red Hat Ansible Automation Platform 2 Not affected automation-hub Red Hat Ansible Automation Platform 2 Not affected automation-platform-ui Red Hat Ansible Automation Platform 2 Not affected python3.11-galaxy-ng Red Hat Ansible Automation Platform 2 Not affected python3.12-galaxy-ng Red Hat Ansible Automation Platform 2 Not affected python3x-galaxy-ng Red Hat Ansible Automation Platform 2 Not affected python-galaxy-ng Red Hat build of Apache Camel for Spring Boot 4 Not affected react-router Red Hat build of Apache Camel for Spring Boot 4 Not affected react-router-dom Red Hat build of Apache Camel - HawtIO 4 Fix deferred react-router Red Hat build of Apache Camel - HawtIO 4 Fix deferred react-router-dom Red Hat build of Apicurio Registry 3 Out of support scope apicurio/apicurio-registry-ui-rhel8 Red Hat build of Apicurio Registry 3 Fix deferred apicurio/apicurio-registry-ui-rhel9 Red Hat Build of Keycloak Fix deferred react-router Red Hat Build of Keycloak Fix deferred react-router-dom Red Hat Build of Podman Desktop Not affected rh-podman-desktop.git Red Hat Ceph Storage 5 Not affected rhceph/rhceph-5-dashboard-rhel8 Red Hat Ceph Storage 9 Not affected rhceph/alloy-rhel10 Red Hat Connectivity Link 1 Not affected rhcl-1/rhcl-console-plugin-rhel9 Red Hat Data Grid 8 Not affected react-router Red Hat Data Grid 8 Not affected react-router-dom Red Hat Developer Hub Fix deferred rhdh/rhdh-hub-rhel9 Red Hat Discovery 2 Not affected discovery/discovery-ui-rhel9 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-ui-ocp-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-ui-ocp-rhel9 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-ui-rhel10 Red Hat Edge Manager 1 Fix deferred rhem/flightctl-ui-rhel9 Red Hat Enterprise Linux 10 Not affected cockpit-image-builder Red Hat Enterprise Linux 10 Not affected firefox Red Hat Enterprise Linux 10 Not affected goose Red Hat Enterprise Linux 10 Not affected grafana Red Hat Enterprise Linux 10 Not affected grafana-pcp Red Hat Enterprise Linux 10 Not affected ipa Red Hat Enterprise Linux 10 Not affected thunderbird Red Hat Enterprise Linux 7 Not affected firefox Red Hat Enterprise Linux 8 Not affected cockpit-composer Red Hat Enterprise Linux 8 Not affected dotnet5.0-build-reference-packages Red Hat Enterprise Linux 8 Not affected firefox Red Hat Enterprise Linux 8 Not affected grafana Red Hat Enterprise Linux 8 Not affected pcs Red Hat Enterprise Linux 8 Not affected thunderbird Red Hat Enterprise Linux 9 Not affected cockpit-composer Red Hat Enterprise Linux 9 Not affected firefox Red Hat Enterprise Linux 9 Not affected goose Red Hat Enterprise Linux 9 Not affected grafana Red Hat Enterprise Linux 9 Not affected ipa Red Hat Enterprise Linux 9 Not affected thunderbird Red Hat Hardened Images Not affected grafana12.4 Red Hat Hardened Images Not affected grafana13.1 Red Hat Hardened Images Not affected opentelemetry-collector Red Hat Hardened Images Not affected opentelemetry-collector-contrib Red Hat Hardened Images Not affected prometheus3.13 Red Hat Hardened Images Not affected prometheus3.5 Red Hat JBoss Enterprise Application Platform 8 Not affected react-router Red Hat JBoss Enterprise Application Platform 8 Not affected react-router-dom Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected react-router Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected react-router-dom Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-dashboard-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mod-arch-automl-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mod-arch-autorag-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mod-arch-eval-hub-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mod-arch-gen-ai-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mod-arch-maas-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mod-arch-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mod-arch-model-registry-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-agent-installer-ui-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-console Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-console-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-monitoring-plugin-rhel8 Red Hat OpenShift Container Platform 4 Fix deferred openshift4/ose-monitoring-plugin-rhel9 Red Hat Openshift Data Foundation 4 Fix deferred odf4/ocs-client-console-rhel9 Red Hat Openshift Data Foundation 4 Fix deferred odf4/odf-console-rhel9 Red Hat Openshift Data Foundation 4 Fix deferred odf4/odf-multicluster-console-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/dashboard-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/openvsx-rhel9 Red Hat OpenShift distributed tracing 3 Not affected rhosdt/tempo-jaeger-query-rhel9 Red Hat OpenShift GitOps Not affected openshift-gitops-1/argocd-rhel8 Red Hat OpenShift GitOps Not affected openshift-gitops-1/argocd-rhel9 Red Hat OpenShift GitOps Not affected openshift-gitops-1/console-plugin-rhel8 Red Hat OpenShift GitOps Not affected openshift-gitops-1/console-plugin-rhel9 Red Hat OpenShift Virtualization 4 Not affected container-native-virtualization/kubevirt-console-plugin Red Hat OpenShift Virtualization 4 Out of support scope container-native-virtualization/kubevirt-console-plugin-rhel9 Red Hat OpenStack Platform 17.1 Not affected qpid-dispatch Red Hat Quay 3 Out of support scope quay/quay-rhel8 Red Hat Quay 3 Not affected quay/quay-rhel9 Red Hat Satellite 6 Not affected nodejs-react-router Red Hat Satellite 6 Not affected nodejs-react-router-dom Red Hat Satellite 6 Not affected satellite/iop-advisor-frontend-rhel9 Red Hat Satellite 6 Not affected satellite/iop-host-inventory-frontend-rhel9 Red Hat Satellite 6 Fix deferred satellite/iop-vulnerability-frontend-rhel9 Red Hat Single Sign-On 7 Not affected react-router Red Hat Single Sign-On 7 Not affected react-router-dom Red Hat Trusted Artifact Signer Not affected rhtas/rhtas-console-ui-rhel9 Red Hat Trusted Profile Analyzer Not affected rhtpa/rhtpa-trustification-service-rhel9 Red Hat Trusted Profile Analyzer Not affected rhtpa/rhtpa-rhel10 Secrets Management Console for Red Hat OpenShift Not affected external-secrets-management/console-plugin-rhel9 Self-service automation portal 2 Fix deferred ansible-automation-platform/automation-portal https://www.cve.org/CVERecord?id=CVE-2026-53668 https://nvd.nist.gov/vuln/detail/CVE-2026-53668 https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180 https://github.com/remix-run/react-router/commit/3a5b5ad0e5cf9918c646509563f5c41a89226ff3 https://github.com/remix-run/react-router/pull/14718 https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0 https://github.com/remix-run/react-router/security/advisories/GHSA-jjmj-jmhj-qwj2