{"schema_version":"1.9.0","id":"GHSA-h8fp-f39c-q6mh","published":"2026-07-23T19:35:57Z","modified":"2026-09-10T03:50:52.323492500Z","aliases":["CVE-2026-53667"],"summary":"React Router: RSCErrorHandler Missing Protocol Validation (XSS)","details":"This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62.  React Router was alerted of a code path in the (unstable) RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect targets\n\n> [!NOTE]\n> This only affects your application if you are using the unstable RSC APIs","affected":[{"package":{"name":"react-router","ecosystem":"npm","purl":"pkg:npm/react-router"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.11.0"},{"fixed":"7.18.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-h8fp-f39c-q6mh/GHSA-h8fp-f39c-q6mh.json"}}],"references":[{"type":"WEB","url":"https://github.com/remix-run/react-router/security/advisories/GHSA-h8fp-f39c-q6mh"},{"type":"WEB","url":"https://github.com/remix-run/react-router/pull/15177"},{"type":"WEB","url":"https://github.com/remix-run/react-router/commit/ce596e823f0d7b883a433af1d5a839a8b9fe0242"},{"type":"PACKAGE","url":"https://github.com/remix-run/react-router"},{"type":"WEB","url":"https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180"},{"type":"WEB","url":"https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0"}],"database_specific":{"cwe_ids":["CWE-79"],"github_reviewed":true,"github_reviewed_at":"2026-07-23T19:35:57Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N"}]}