CVE-2026-53668

Katalog CVE

CVSS 6.9 · Medium EPSS 0,34%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada shopify react-router. Skor CVSS 3.1 6.9 (Medium) menurut github.com.

Deskripsi (NVD)

React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.

Rincian

Terbit di NVD

27 Juli 2026

Terakhir diubah

3 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

6.9 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/remix-run/react-router/commit/3a5b5ad0e5cf9918c646509563f5c41a89226ff3 patch
• https://github.com/remix-run/react-router/pull/14718 issue tracking · patch
• https://github.com/remix-run/react-router/security/advisories/GHSA-jjmj-jmhj-qwj2 advisory pihak ketiga
• https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180 release notes
• https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0 release notes