CVE-2026-53668

A flaw was found in React Router. Applications using React Router that allow open redirects are vulnerable to Cross-Site Scripting (XSS). A remote attacker could craft a malicious link that, when clicked by a user, redirects them to an unexpected external site or exploits an XSS vulnerability, potentially leading to information disclosure or unauthorized actions.

React Router (npm packages react-router and react-router-dom) versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0 contain an open redirect flaw. Applications that use React Router's navigation APIs (for example Navigate, redirect(), or loader/action responses) to redirect users to a URL derived from untrusted input, without validating that the target is an allow-listed internal or trusted destination, can be made to redirect a victim to an attacker-controlled site. In addition to the redirect itself, a crafted target URL can be used to achieve Cross-Site Scripting (XSS) against the vulnerable application, potentially exposing session data or allowing unauthorized actions in the context of the redirecting origin. This issue is fixed upstream in react-router/react-router-dom 7.13.0.

This flaw is only reachable in Red Hat products that both bundle an affected version of react-router/react-router-dom in a web console or UI component AND implement an open redirect pattern (redirecting to a caller-supplied or otherwise untrusted URL) in that component's own routing code. Simply bundling react-router as a dependency does not by itself make a product exploitable; each console/UI must be independently assessed by its owning component team for whether it constructs redirects from untrusted input.

Red Hat's CVSS score (6.9, AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N) matches the upstream/CVE.org self-assigned score exactly, so no Red Hat-specific re-scoring was applied. For comparison, a related but distinct prior React Router open-redirect-to-XSS flaw (CVE-2026-22029) was scored higher by Red Hat (8.0, Important) with Integrity High rather than Low; that difference is consistent with the upstream advisories describing different underlying primitives, and Red Hat's score here mirrors the vendor's own (lower) assessment of this specific issue's integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

There is no mitigation available other than upgrading to react-router/react-router-dom 7.13.0 or later once the fix is packaged in the affected Red Hat products. As a defense-in-depth measure independent of this specific flaw, applications should always validate redirect targets against an allow-list of internal/trusted destinations before passing them to React Router's navigation or redirect APIs, rather than redirecting directly to caller-supplied URLs.