PT-2026-64213 · Npm · React Router

CVE-2026-53667 · Publicado 2026-07-23 · Atualizado 2026-07-23

OSV

CVSS v3.1

6.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the (unstable) RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect targets

[!NOTE] This only affects your application if you are using the unstable RSC APIs

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-53667

GHSA-H8FP-F39C-Q6MH

Produtos afetados

React Router

Referências · 7

• https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0 · Nota
• https://github.com/remix-run/react-router/commit/ce596e823f0d7b883a433af1d5a839a8b9fe0242 · Nota
• https://github.com/remix-run/react-router/security/advisories/GHSA-h8fp-f39c-q6mh · Nota
• https://github.com/remix-run/react-router/pull/15177 · Nota
• https://github.com/remix-run/react-router · Nota
• https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180 · Nota
• https://osv.dev/vulnerability/GHSA-h8fp-f39c-q6mh · Aviso do Fabricante