Skip to main content

React Router CVE-2026-53669

MEDIUM
URL Redirection to Untrusted Site (Open Redirect) (CWE-601)
2026-07-23 https://github.com/remix-run/react-router GHSA-wrjc-x8rr-h8h6
Open Redirect Red Hat Suse
5.1
CVSS 4.0 · Vendor: https://github.com/remix-run/react-router
Share

Severity by source

Vendor (https://github.com/remix-run/react-router) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.7 MEDIUM

Network-reachable open redirect requiring no privileges; user interaction required to follow crafted link; scope changes to external host but vulnerable system itself has no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Red Hat
5.4 MEDIUM
qualitative

Primary rating from Vendor (https://github.com/remix-run/react-router).

CVSS VectorVendor: https://github.com/remix-run/react-router

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

4
CVSS changed
Jul 27, 2026 - 22:22 NVD
5.1 (MEDIUM)
Source Code Evidence Fetched
Jul 23, 2026 - 20:03 vuln.today
Analysis Generated
Jul 23, 2026 - 20:03 vuln.today
CVE Published
Jul 23, 2026 - 19:38 cve.org
MEDIUM

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 25 npm packages depend on react-router (7 direct, 19 indirect)

Ecosystem-wide dependent count for version 6.0.0.

DescriptionCVE.org

This is a follow up to CVE-2025-68470. React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations.

AnalysisAI

Open redirect in React Router (npm package, versions 6.0.0 through 7.17.x) allows bypass of the prior CVE-2025-68470 patch via attacker-supplied paths containing mixed backslash and forward-slash sequences (e.g., \\evil.com, /\evil.com, \/evil.com) passed to navigation APIs including useNavigate() and the Link component. Browsers interpret these malformed protocol-relative URL patterns as pointing to external hosts, enabling unexpected external navigation. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis; vendor-released patch v7.18.0 is available.

Technical ContextAI

React Router is a widely-used npm package (pkg:npm/react-router) providing client-side routing for React applications. The root cause is CWE-601 (URL Redirection to Untrusted Site / Open Redirect): the library's URL normalization logic failed to fully sanitize protocol-relative URL patterns before navigation. The prior fix for CVE-2025-68470 only detected the standard // prefix using a hardcoded startsWith('//') check, leaving mixed-separator variants (\\, /\, \/) unhandled. Browsers treat all of these as protocol-relative URLs pointing to the hostname that follows. The fix in PR #15176 consolidates normalization into a new url.ts module, introduces PROTOCOL_RELATIVE_URL_REGEX = /^[\/]{2}/ to catch all combinations, adds a normalizeProtocolRelativeUrl helper, and updates ABSOLUTE_URL_REGEX to /^(?:[a-z][a-z0-9+.-]*:|[\/]{2})/i. Tests confirm that resolvePath('\\foo'), resolvePath('/\foo'), and resolvePath('\/foo') all now resolve to the internal pathname /foo rather than treating the argument as an external target.

RemediationAI

Upgrade react-router to version 7.18.0 or later, which is the vendor-confirmed fix (https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0). The underlying patch is available at https://github.com/remix-run/react-router/pull/15176. If immediate upgrade is not feasible, apply application-layer input sanitization to reject or strip backslash characters from any user-supplied string before it is passed to useNavigate(), the Link component's to prop, or any redirect response - note this is a compensating control with the trade-off that it may reject legitimate encoded paths on some platforms. Additionally, audit all application entry points that accept user-controlled navigation targets (URL query parameters, form fields, deep-link handlers) and enforce an allowlist of acceptable path prefixes where possible. These controls do not substitute for patching.

More in Open Redirect

View all
CVE-2017-1000117 HIGH POC
8.8 Oct 05

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
CVE-2024-52875 HIGH POC
8.8 Jan 31

GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
CVE-2016-5385 HIGH POC
8.1 Jul 19

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
CVE-2013-2248 MEDIUM POC
5.8 Jul 20

Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
CVE-2012-6499 MEDIUM POC
5.8 Jan 12

Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows

CVE-2015-2863 MEDIUM POC
4.3 Jul 20

Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
CVE-2017-3528 MEDIUM POC
5.4 Apr 24

Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
CVE-2012-0518 MEDIUM
4.7 Oct 16

Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
CVE-2024-21641 MEDIUM POC
6.5 Jan 05

Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
CVE-2015-5354 MEDIUM POC
5.8 Jul 01

Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites

CVE-2015-5461 MEDIUM POC
6.4 Jul 08

Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for

CVE-2024-22891 CRITICAL POC
9.8 Mar 01

Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit

Same weakness CWE-601 – URL Redirection to Untrusted Site (Open Redirect)

View all
CVE-2017-1000117 HIGH POC
8.8
CVE-2016-5385 HIGH POC
8.1
CVE-2017-3528 MEDIUM POC
5.4
CVE-2012-0518 MEDIUM
4.7
CVE-2024-21641 MEDIUM POC
6.5
CVE-2015-5354 MEDIUM POC
5.8
CVE-2024-22891 CRITICAL POC
9.8
CVE-2022-40083 CRITICAL POC
9.6

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Module for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.0 Not-Affected
SUSE Linux Enterprise Server 16.1 Not-Affected

Share

CVE-2026-53669 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy