CVE-2026-53668

—

CVSS 3.1

6.9 medium

EPSS

<1%p20

Published

Jul 27, 2026 (Jul 27, 2026)

Modified

Sep 8, 2026

Description

React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.

Vendors: shopify
Products: react-router
Ecosystems: npm
Weakness: CWE-79, CWE-601
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
GHSA: GHSA-jjmj-jmhj-qwj2 (medium)

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.