CVE-2026-53668
Fixed in a distro release EPSS <1%CVSS 6.9
React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.
Products: remix-run react-router
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | react-router | 7.13.0 |
| npm | react-router-dom | 6.30.6 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | keycloak-26.5 | no fix |
| Chainguard | keycloak-26.5-iamguarded-compat | no fix |
| Chainguard | keycloak-26.6 | 26.6.7-r0 |
| Chainguard | keycloak-26.6-iamguarded-compat | 26.6.7-r0 |
| Chainguard | keycloak-26.7 | 26.7.3-r0 |
| Chainguard | keycloak-26.7-iamguarded-compat | 26.7.3-r0 |
| Chainguard | librechat | 0.8.7-r7 |
| Wolfi | keycloak-26.5 | no fix |
| Wolfi | keycloak-26.5-iamguarded-compat | no fix |
| Wolfi | keycloak-26.6 | 26.6.7-r0 |
| Wolfi | keycloak-26.6-iamguarded-compat | 26.6.7-r0 |