Dashboard / CVE-2026-53668

CVE-2026-53668

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 54/100
Published: 2026-07-27 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network No Auth Conf. Impact Scope Change

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: Required
S: Changed
C: High
I: Low
A: None

Description

React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.

Weakness Classification (2)

Affected Software (2)

VendorProductVersion
shopify react-router 6.30.2 – 6.30.4
shopify react-router 7.9.6 – 7.13.0

References & Advisories (5)

Bug Bounty Relevance

54 / 100
✓ Network accessible
✓ No authentication

CVSS Score

6.9 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

EPSS — Exploitation Probability

0.34%
Raw Score 0.003410
Percentile 27.6%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00341
2026-10-28
0.00341

Intelligence Sources

nvd ref →

External Links