CVE-2026-53668

What it actually does

The vulnerability permits cross-site scripting in React Router versions 6.30.2-6.30.4 and 7.9.6-7.12.0 when open redirect functionality is present, allowing an attacker to craft a link that triggers redirection to an attacker-controlled site while injecting executable script into the victim page context.

Why it matters to the business

Organizations using affected React Router releases in applications with redirect features face elevated risk of user session compromise or data theft through malicious links, increasing support costs and potential regulatory exposure until libraries are updated.

How an attack unfolds

An attacker identifies an application using a vulnerable React Router version that permits open redirects, then crafts a specially formatted URL containing both a redirect target and an XSS payload. The link is distributed via phishing or other channels; when a user clicks it, the router processes the redirect and executes the injected script in the user's browser context, enabling actions such as cookie theft or unauthorized actions on the original domain.

How to fix it

Upgrade React Router to version 7.13.0 or later for all affected applications. Review and restrict any open redirect implementations to trusted destinations only. Apply input validation and output encoding on all redirect parameters.

How to confirm the fix worked

Confirm React Router version is 7.13.0 or newer in package manifests and dependency trees. Test redirect flows with known malicious payloads to verify script execution is blocked. Re-scan applications with web vulnerability scanners after upgrade.

Typical attack path

1. Identify application using vulnerable React Router release with open redirect capability
2. Craft malicious URL embedding redirect parameter and XSS payload
3. Deliver link to target users via email, messaging, or web content
4. User interaction triggers router handling that performs redirect and executes script
5. Attacker receives exfiltrated data or performs actions within victim session

How to detect it

Review web server and application logs for redirect parameters containing external domains or suspicious script fragments. Monitor for unusual outbound requests from user sessions that originated from internal application URLs. Check browser console logs or security event reports for unexpected script execution errors tied to routing paths.

What your security team should do

• Prioritize upgrade of React Router to 7.13.0 across all projects within 30 days
• Audit codebases for use of open redirect patterns and replace with allow-listed destinations
• Add dependency scanning to CI pipelines to prevent reintroduction of vulnerable versions
• Educate development teams on safe redirect handling practices