Description
React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.
Published: 2026-07-27
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

React Router versions 6.30.2–6.30.4 and 7.9.6–7.12.0 contain an open‑redirect flaw that enables attackers to inject and execute arbitrary script code in a user’s browser. Attackers can craft a malicious URL that redirects users to an unintended external site or carries an XSS payload, potentially stealing session cookies, defacing the interface, or redirecting to a phishing page.

Affected Systems

The vulnerable product is Remix Run’s React Router. Any application that uses the affected version ranges listed above and permits open redirects is impacted.

Risk and Exploitability

The CVSS score is 6.9, indicating high severity. The EPSS score is 0.00335 (<1%), and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to click a crafted link, so the attack vector is user interaction; however, because the redirect can load arbitrary domains, phishing or cross‑site scripting attacks are possible.

Generated by OpenCVE AI on August 3, 2026 at 15:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade React Router to version 7.13.0 or later.
  • If an upgrade is not immediately possible, disable or restrict open‑redirect functionality and validate redirect destinations to ensure they point only to trusted domains.
  • Deploy a strong Content‑Security‑Policy that blocks script execution from untrusted sources.

Generated by OpenCVE AI on August 3, 2026 at 15:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-jjmj-jmhj-qwj2 React Router: Open redirect leading to XSS
History

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

threat_severity

Moderate

Tue, 28 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
First Time appeared Remix-run
Remix-run react-router
Vendors & Products Remix-run
Remix-run react-router

Mon, 27 Jul 2026 23:30:00 +0000

Type Values Removed Values Added
Description React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.
Title React Router: Open redirect can lead to XSS
Weaknesses CWE-601
CWE-79
References
Metrics cvssV3_1

{'score': 6.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N'}

Subscriptions

Remix-run React-router
Shopify React-router
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-28T13:44:11.335Z

Reserved: 2026-06-09T20:50:36.877Z

Link: CVE-2026-53668

cve-icon Vulnrichment

Updated: 2026-07-28T13:44:05.695Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-27T22:17:31.237

Modified: 2026-08-03T14:13:34.623

Link: CVE-2026-53668

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-27T21:42:17Z

Links: CVE-2026-53668 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T15:45:04Z

Weaknesses
  • CWE-601

    URL Redirection to Untrusted Site ('Open Redirect')

  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')