GitHub Advisoryadvisory · npm

GHSA-h8fp-f39c-q6mh React Router: RSCErrorHandler Missing Protocol Validation (XSS)

MEDIUM Published 2026-07-23 Modified 2026-07-23 Official page ↗
Aliases
CVE-2026-53667
Ecosystem
npm
Packages
react-router
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
Weaknesses
CWE-79
Reviewed
2026-07-23

Affected packages

• npm react-router: >= 7.11.0, < 7.18.0 → fixed in 7.18.0

Description

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the (unstable) RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect targets > [!NOTE] > This only affects your application if you are using the unstable RSC APIs

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References