CVE-2026-53669

What it actually does

The vulnerability permits an open redirect by accepting backslashes in Link components and useNavigate calls, allowing navigation to external domains disguised as relative paths.

Why it matters to the business

Attackers can trick users into visiting malicious sites, potentially leading to phishing attacks or malware infection, increasing risk for organizations using affected versions of the routing library in web applications.

How an attack unfolds

An attacker crafts a malicious URL containing backslashes that, when processed by the vulnerable Link or navigate function, redirects the user to an attacker-controlled domain instead of the intended internal path.

How to fix it

Upgrade React Router to version 7.18.0 or later. For affected packages apply updates to prometheus3-13-main fixed in 3.13.1-0.5.hum1 and prometheus3-5-main fixed in 3.5.5-0.6.hum1 as per RHSA-2026:48780.

How to confirm the fix worked

Verify the version of React Router in use is 7.18.0 or higher. Test that paths containing backslashes do not result in external redirects.

Typical attack path

1. Identify a vulnerable application using React Router versions 6.0.0 through 7.17.0
2. Craft a URL embedding backslashes to trigger the redirect logic
3. Lure a user to click or navigate via the malicious link
4. User browser follows the redirect to an attacker-controlled external site

How to detect it

Examine web server and application logs for redirect responses containing unexpected external domains triggered from internal navigation links. Search for URL patterns with backslashes in parameters passed to routing functions.

What your security team should do

• Apply the listed fixed versions immediately given the 91 days since publication
• Audit all applications for usage of Link and useNavigate with user-supplied input
• Implement Content-Security-Policy headers to limit redirect targets as a compensating control