CVE-2026-53667 | CyberRota

CyberRota Analysis

AI-Generated

Versions 7.11.0 through 7.17.0 of React Router are vulnerable due to the RSCErrorHandler lacking protocol validation, which permits redirects from untrusted sources. This could lead to potential phishing attacks or unauthorized access in applications utilizing the unstable RSC APIs. Developers using affected versions should prioritize upgrading to version 7.18.0 to mitigate these risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE

CVE-2026-53667

Severity

MEDIUM

CVSS

6.9

EPSS

0.20%

Original NVD Description

React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the unstable RSC APIs. This issue has been fixed in version 7.18.0.

Related CVEs

Other vulnerabilities affecting the same vendor(s)

CVE-2026-55685 HIGH CVE-2026-53669 MEDIUM CVE-2026-53668 MEDIUM CVE-2026-53666 MEDIUM CVE-2026-42342 HIGH CVE-2026-42211 HIGH