← All CVEs
CVE-2026-53667
Medium · CVSS 6.9Published 2026-07-27
CVSS
6.9
EPSS
—
Exploited
No
Summary
React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the unstable RSC APIs. This issue has been fixed in version 7.18.0.
References
- https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180
- https://github.com/remix-run/react-router/commit/ce596e823f0d7b883a433af1d5a839a8b9fe0242
- https://github.com/remix-run/react-router/pull/15177
- https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0
- https://github.com/remix-run/react-router/security/advisories/GHSA-h8fp-f39c-q6mh
Is your stack affected?
Pentevo's AI pentest continuously checks your systems against known vulnerabilities like this one.
Recent CVEs
- CVE-2026-65441Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.7.1
- CVE-2026-65442Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions.7.2
- CVE-2026-65443Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions.7.1
- CVE-2026-65445Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions.6.5
- CVE-2026-65446Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions.7.1
- CVE-2026-65447Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.7.1