{"id":"GHSA-h8fp-f39c-q6mh","revision":"55ee1a6087514c64a362946211802ac1","records":[{"revision":"55ee1a6087514c64a362946211802ac1","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-h8fp-f39c-q6mh","aliases":["CVE-2026-53667"],"title":"React Router: RSCErrorHandler Missing Protocol Validation (XSS)","description":"This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62.  React Router was alerted of a code path in the (unstable) RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect targets\n\n> [!NOTE]\n> This only affects your application if you are using the unstable RSC APIs","state":0,"publishedAt":"2026-07-23T19:35:57+00:00","modifiedAt":"2026-09-10T03:50:52.3234925+00:00","affected":[{"ecosystem":"npm","name":"react-router","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"7.11.0"},{"kind":"fixed","version":"7.18.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/remix-run/react-router/security/advisories/GHSA-h8fp-f39c-q6mh","https://github.com/remix-run/react-router/pull/15177","https://github.com/remix-run/react-router/commit/ce596e823f0d7b883a433af1d5a839a8b9fe0242","https://github.com/remix-run/react-router","https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180","https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0"],"sourceUrl":"https://github.com/advisories/GHSA-h8fp-f39c-q6mh","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-h8fp-f39c-q6mh","identifiers":["GHSA-h8fp-f39c-q6mh","CVE-2026-53667"]},"retained":false,"historicalAffected":[]}],"coverage":[]}