---
id: CVE-2026-53668
aliases:
  - GHSA-jjmj-jmhj-qwj2
title: 'React Router: Open redirect leading to XSS'
summary: 'React Router: Open redirect leading to XSS'
severity: medium
cvss: 6.9
cwe:
  - CWE-79
  - CWE-601
vendor: react-router
product: react-router
ecosystem: npm
affected:
  - 'react-router >= 7.9.6, <= 7.12.0'
  - 'react-router-dom >= 6.30.2, <= 6.30.5'
patched:
  - react-router 7.13.0
  - react-router-dom 6.30.6
published: '2026-07-23'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T15:09:29Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-jjmj-jmhj-qwj2'
references:
  - url: >-
      https://github.com/remix-run/react-router/security/advisories/GHSA-jjmj-jmhj-qwj2
  - url: 'https://github.com/remix-run/react-router/pull/14718'
  - url: >-
      https://github.com/remix-run/react-router/commit/3a5b5ad0e5cf9918c646509563f5c41a89226ff3
  - url: 'https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180'
  - url: 'https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53668'
  - url: 'https://github.com/remix-run/react-router/blob/v6/CHANGELOG.md#v6306'
  - url: 'https://github.com/remix-run/react-router/releases/tag/react-router@6.30.6'
  - url: 'https://github.com/advisories/GHSA-jjmj-jmhj-qwj2'
tags:
  - ghsa
  - npm
epss: 0.00341
epssPercentile: 0.2482
ingestedAt: '2026-07-23T20:19:19.525Z'
---

## Overview

Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors.

## Affected packages

- `react-router >= 7.9.6, <= 7.12.0`
- `react-router-dom >= 6.30.2, <= 6.30.5`

## Remediation

Upgrade to a patched release:

- `react-router 7.13.0`
- `react-router-dom 6.30.6`