Open redirect in React Router - CVE-2026-53668
Published: July 22, 2026
Vulnerability identifier: #VU139177
CSH Severity: Medium
CVSS v4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-53668
CWE-ID: CWE-601
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information or perform cross-site scripting.
The vulnerability exists due to improper input validation in redirect handling when processing attacker-crafted links. A remote attacker can supply a specially crafted link to trigger a redirect to an unexpected external location or an XSS vector to disclose sensitive information or perform cross-site scripting.
User interaction is required to follow the crafted link.
Affected software
React Router
IBM SPSS Collaboration and Deployment Services
IBM SPSS Collaboration and Deployment Services
How to mitigate CVE-2026-53668
Install security update from vendor's website.
React Router - update to 7.13.0