CVE-2026-53668
Description
A flaw was found in React Router. Applications using React Router that allow open redirects are vulnerable to Cross-Site Scripting (XSS). A remote attacker could craft a malicious link that, when clicked by a user, redirects them to an unexpected external site or exploits an XSS vulnerability, potentially leading to information disclosure or unauthorized actions.
Statement
React Router (npm packages react-router and react-router-dom) versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0 contain an open redirect flaw. Applications that use React Router's navigation APIs (for example Navigate, redirect(), or loader/action responses) to redirect users to a URL derived from untrusted input, without validating that the target is an allow-listed internal or trusted destination, can be made to redirect a victim to an attacker-controlled site. In addition to the redirect itself, a crafted target URL can be used to achieve Cross-Site Scripting (XSS) against the vulnerable application, potentially exposing session data or allowing unauthorized actions in the context of the redirecting origin. This issue is fixed upstream in react-router/react-router-dom 7.13.0.
This flaw is only reachable in Red Hat products that both bundle an affected version of react-router/react-router-dom in a web console or UI component AND implement an open redirect pattern (redirecting to a caller-supplied or otherwise untrusted URL) in that component's own routing code. Simply bundling react-router as a dependency does not by itself make a product exploitable; each console/UI must be independently assessed by its owning component team for whether it constructs redirects from untrusted input.
Red Hat's CVSS score (6.9, AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N) matches the upstream/CVE.org self-assigned score exactly, so no Red Hat-specific re-scoring was applied. For comparison, a related but distinct prior React Router open-redirect-to-XSS flaw (CVE-2026-22029) was scored higher by Red Hat (8.0, Important) with Integrity High rather than Low; that difference is consistent with the upstream advisories describing different underlying primitives, and Red Hat's score here mirrors the vendor's own (lower) assessment of this specific issue's integrity impact.
Mitigation
There is no mitigation available other than upgrading to react-router/react-router-dom 7.13.0 or later once the fix is packaged in the affected Red Hat products. As a defense-in-depth measure independent of this specific flaw, applications should always validate redirect targets against an allow-list of internal/trusted destinations before passing them to React Router's navigation or redirect APIs, rather than redirecting directly to caller-supplied URLs.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.9 | N/A | 6.9 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Changed | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
The user may be redirected to an untrusted page that contains malware which may then compromise the user's system. In some cases, an open redirect can also enable the immediate download of a file without the user's permission, because the redirection to an external site may lead to endpoints on those sites that automatically trigger a download action ("drive-by download" [REF-1478]). This will expose the user to extensive risk. The user's interaction with the web server may also be compromised if the malware conducts keylogging or other attacks that steal credentials, personally identifiable information (PII), or other important data.
Access Control,Confidentiality,Other
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity; Other
By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam. The user may be subjected to phishing attacks by being redirected to an untrusted page. The phishing attack may point to an attacker controlled web page that appears to be a trusted web site. The phishers may then steal the user's credentials and then use these credentials to access the legitimate web site. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
