CVE-2026-53669: remix-run react-router Open Redirect
CVSS: 6.1v3.1MediumAnalyzed
AliasesRHSA-2026:48780RHSA-2026:48799CGA-3v3q-ph6q-5hmjCGA-446j-f459-gcmxCGA-4vjf-rcqm-wpfvCGA-6wx4-249j-8xrjCGA-fv9m-jv73-22fpCGA-h9h2-h5g6-ww2hCGA-hf2q-hrpm-5f2jCGA-rqv7-3xqc-r3fmCGA-x7m9-v477-99qcGHSA-wrjc-x8rr-h8h6CGA-568c-p9gc-xggjCGA-5whg-57jm-j8q8CGA-7v8j-j946-f66hCGA-c7rp-cc6g-h2xgCGA-hcwq-9fcj-2c4mCGA-hg4r-9mhv-mh43CGA-jgfg-9fgm-jggpCGA-p2j5-rx2j-xv28CGA-pj37-ggfg-g4pgCGA-vj6f-vxjp-2f39CGA-vprc-h8jw-pgvxCGA-wqhf-g34c-qmv5
Published 27-07-2026Last modified 28-07-2026
Vulnerability summary
CVE-2026-53669 is a medium (CVSS 6.1) Open Redirect vulnerability in remix-run react-router. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.4% of scored vulnerabilities.
CVSS score
6.1/10
010
Medium · v3.1 (NVD)EPSS score
0.32%
0%100%
Low · +0.09 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 27-07-2026PublishedVulnerability first disclosed.
- 28-07-2026Last modifiedVulnerability information updated.
Description
React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in <Link> and useNavigate. This issue is a follow up to CVE-2025-68470 and has been fixed in version 7.18.0.
CVSS metrics
7 scores · 6 sources · 2 versionsMedium 5.1Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:NSourcesAll 5 agree
- OSV · WolfiEcosystem advisory · calculated5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
- OSV · NpmEcosystem advisory · calculated5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
- OSV · ChainguardEcosystem advisory · calculated5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
- NVDNIST5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 6.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NSources2 sources · 5.4–6.1
- OSV · Red hatEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.32%
Chance of exploitation in the next 30 days
Percentile
23%
Versus all other CVEs
30-day change
+0.09 pp
From 0.23% on 20-09-2026
20-09-202620-10-2026
EPSS score0.32%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard9 products
- airflow-2All versions (No fix recorded)
- airflow-core-2All versions (No fix recorded)
- keycloak-26.5< 26.5.7-r3
- keycloak-26.5-iamguarded-compat< 26.5.7-r3
- keycloak-26.7< 26.7.2-r1
Wolfi4 products
- keycloak-26.5< 26.5.7-r3
- keycloak-26.5-iamguarded-compat< 26.5.7-r3
- vitess-24< 24.0.2-r7
- vitess-24-compat< 24.0.3-r7
Redhat2 products
- prometheus3.13< 0:3.13.1-0.5.hum1
- prometheus3.5< 0:3.5.5-0.6.hum1
Npm1 product
- react-router≥ 6.0.0, < 7.18.0
Remix-run1 product
- react-router≥ 6.0.0, < 7.18.0
Shopify1 product
- react-router≥ 6.0.0, < 7.18.0
6 vendors · 18 products
References
17 links- github.com/remix-run/react-router/security/advisories/GHSA-wrjc-x8rr-h8h6X Refsource CONFIRMARTICLEAdvisoryWEBThird Party Advisory
- github.com/remix-run/react-router/releases/tag/react-router@7.18.0X Refsource MISCARTICLEWEBRelease Notes
- images.redhat.comARTICLE
