What is the CVSS score of CVE-2026-53668?

CVE-2026-53668 has a CVSS 3.1 base score of 6.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-53668?

Yes, a patch is available for CVE-2026-53668. Update the affected software to the latest version immediately.

React Router CVE-2026-53668

Q: Which versions of React Router are affected by CVE-2026-53668?

Open redirect in React Router's `resolvePath` utility allows attackers to craft navigation URLs using protocol-relative paths (`//external.com`) or colon-containing relative paths that the library…. A patch is available.

EUVD-2026-49633 MEDIUM

URL Redirection to Untrusted Site (Open Redirect) (CWE-601)

2026-07-23 https://github.com/remix-run/react-router

GHSA-jjmj-jmhj-qwj2

XSS Open Redirect Red Hat

6.9

CVSS 3.1 · Vendor: https://github.com/remix-run/react-router

Severity by source

Vendor (https://github.com/remix-run/react-router) PRIMARY

6.9 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

vuln.today AI

6.9 MEDIUM

AC:H because exploitation requires app to expose attacker-controlled input to navigation APIs; S:C and C:H reflect XSS cross-origin session theft; UI:R for mandatory victim click.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Red Hat

6.9 MEDIUM

qualitative

Primary rating from Vendor (https://github.com/remix-run/react-router).

CVSS VectorVendor: https://github.com/remix-run/react-router

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 20:03 vuln.today

Analysis Generated

Jul 23, 2026 - 20:03 vuln.today

CVE Published

Jul 23, 2026 - 19:36 github-advisory

MEDIUM 6.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

20 npm packages depend on react-router (11 direct, 9 indirect)
8 npm packages depend on react-router-dom (7 direct, 1 indirect)

Ecosystem-wide dependent count for version 7.9.6 and other introduced versions.

DescriptionCVE.org

Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors.

AnalysisAI

Open redirect in React Router's resolvePath utility allows attackers to craft navigation URLs using protocol-relative paths (//external.com) or colon-containing relative paths that the library fails to normalize, resulting in external redirects or XSS execution in the victim's browser. Affected packages are react-router (npm) 7.9.6-7.12.0 and react-router-dom (npm) 6.30.2-6.30.4; only react-router has a confirmed fix (7.13.0). No public exploit code and no CISA KEV listing have been identified at time of analysis, though the CVSS scope-change and high confidentiality impact reflect cross-origin session theft potential via XSS.

Technical ContextAI

React Router is the dominant client-side routing library for React applications, distributed as pkg:npm/react-router and pkg:npm/react-router-dom. The vulnerability exists in the resolvePath function (packages/react-router/lib/router/utils.ts) which computed navigation targets for useNavigate and <Link>. The old implementation called isAbsoluteUrl() and, upon matching, passed protocol-relative paths like //external.com through without normalization, allowing them to be interpreted by the browser as external URLs. Separately, relative paths containing colons (e.g., foo:bar) could be misread as URL schemes (e.g., javascript:), introducing an XSS vector. CWE-601 (URL Redirection to Untrusted Site) is the root cause class. The fix in PR #14718 strips leading double slashes unconditionally before any path resolution, and resolves all non-absolute paths relative to the application root, closing both vectors.

RemediationAI

For react-router (7.x), upgrade to version 7.13.0 or later; the upstream fix is confirmed in commit 3a5b5ad0e5cf9918c646509563f5c41a89226ff3 and PR #14718 (https://github.com/remix-run/react-router/pull/14718). For react-router-dom 6.x (versions 6.30.2-6.30.4), no confirmed fixed release was identified in the advisory at time of analysis - monitor https://github.com/remix-run/react-router/security/advisories/GHSA-jjmj-jmhj-qwj2 for updates. As a compensating control, applications should validate and reject any navigation target that begins with // or contains a colon before the first slash before passing it to useNavigate or <Link to=...>; this prevents the open redirect vector regardless of library version. Note that input validation at the application layer introduces maintenance overhead and must be applied consistently at every navigation call site - partial application leaves gaps. Do not rely solely on sanitization as a long-term control once a patch is available.