GHSA-jjmj-jmhj-qwj2
React Router: Open redirect leading to XSS
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | react-router-dom | >= 6.30.2, < 6.30.6 | 6.30.6 |
| npm | react-router | >= 7.9.6, < 7.13.0 | 7.13.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors.
References
External links from the advisory. They lead to third-party sites.
- https://github.com/remix-run/react-router/security/advisories/GHSA-jjmj-jmhj-qwj2
- https://nvd.nist.gov/vuln/detail/CVE-2026-53668
- https://github.com/remix-run/react-router/pull/14718
- https://github.com/remix-run/react-router/commit/3a5b5ad0e5cf9918c646509563f5c41a89226ff3
- https://github.com/remix-run/react-router
- https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180
- https://github.com/remix-run/react-router/blob/v6/CHANGELOG.md#v6306
- https://github.com/remix-run/react-router/releases/tag/[email protected]
- https://github.com/remix-run/react-router/releases/tag/[email protected]