6.9

CVE-2026-53668

React Router: Open redirect can lead to XSS

React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Shopify ≫ React-router SwPlatformnode.js Version >= 6.30.2 <= 6.30.4
Shopify ≫ React-router SwPlatformnode.js Version >= 7.9.6 < 7.13.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.34% 0.262
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 6.9 1.6 4.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180
Release Notes
https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0
Release Notes
https://github.com/remix-run/react-router/security/advisories/GHSA-jjmj-jmhj-qwj2
Third Party Advisory
https://github.com/remix-run/react-router/pull/14718
Patch
Issue Tracking
https://github.com/remix-run/react-router/commit/3a5b5ad0e5cf9918c646509563f5c41a89226ff3
Patch