CVE-2026-53668: React Router: Open redirect can lead to XSS
Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors.
Other sources
React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/react-routerto a version that resolves this vulnerability.Fixed in 7.13.0 - Upgrade
Upgrade
React Routerto a version that resolves this vulnerability.Fixed in 7.13.0 - Compensating control
For React Router versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, mitigate open redirect/XSS by preventing attacker-controlled redirects to unexpected external locations (i.e., do not allow crafted links to trigger redirects).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53668?
CVE-2026-53668 has a medium severity rating of 6.9.
What types of vulnerabilities are associated with CVE-2026-53668?
CVE-2026-53668 is associated with open redirects that can potentially lead to unexpected external redirects or XSS vulnerabilities.
How do I fix CVE-2026-53668?
To fix CVE-2026-53668, ensure that your application validates and sanitizes URLs to mitigate open redirects.
Which software is affected by CVE-2026-53668?
CVE-2026-53668 affects npm packages react-router and react-router-dom.
How can CVE-2026-53668 impact application security?
CVE-2026-53668 can allow attackers to craft links that redirect users to malicious sites or introduce XSS vulnerabilities in applications.