MEDIUM6.9
GHSA-jjmj-jmhj-qwj2
React Router: Open redirect leading to XSS
Quick fix
GHSA-jjmj-jmhj-qwj2 — react-router-dom: upgrade to the fixed version with the command below.
npm install react-router-dom@6.30.6Details
Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/remix-run/react-router/security/advisories/GHSA-jjmj-jmhj-qwj2[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2026-53668[ADVISORY]
- https://github.com/remix-run/react-router/pull/14718[WEB]
- https://github.com/remix-run/react-router/commit/3a5b5ad0e5cf9918c646509563f5c41a89226ff3[WEB]
- https://github.com/remix-run/react-router[PACKAGE]
- https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180[WEB]
- https://github.com/remix-run/react-router/blob/v6/CHANGELOG.md#v6306[WEB]
- https://github.com/remix-run/react-router/releases/tag/react-router@6.30.6[WEB]
- https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0[WEB]