CVE-2026-53667

MEDIUM 6.9

React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667)

CVSS Score

6.9

EPSS Score

0.0%

EPSS Percentile

0th

React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the unstable RSC APIs. This issue has been fixed in version 7.18.0.

CWE	CWE-79
Vendor	remix-run
Product	react-router
Published	Jul 27, 2026

Stay Ahead of the Next One

Get instant alerts for remix-run react-router

Be the first to know when new medium vulnerabilities affecting remix-run react-router are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Affected Versions

remix-run / react-router

>= 7.11.0, < 7.18.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/remix-run/react-router/security/advisories/GHSA-h8fp-f39c-q6mh github.com: https://github.com/remix-run/react-router/pull/15177 github.com: https://github.com/remix-run/react-router/commit/ce596e823f0d7b883a433af1d5a839a8b9fe0242 github.com: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180 github.com: https://github.com/remix-run/react-router/releases/tag/[email protected]