GHSA-WRJC-X8RR-H8H6 React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

This is a follow up to CVE-2025-68470. React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations...

0beny1s (1.1.6), 0desgin (0.0.1) +15936 more potentially affected by CVE-2026-53669 via react-router (>=6.0.0, <=7.17.0)

react-router NPM version =6.0.0, =7.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on react-router and may be impacted: - 0beny1s 1.1.6 - 0desgin 0.0.1 - 0scarclassa 1.0.1 - 0scarclassb 1.0.1 - 0scarclassc 1.0.1 - 0scarclassd 1.0.1 - 0scarclasse 1.0...

React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

This is a follow up to CVE-2025-68470. React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations...

NPM: React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

NPM: React Router: Open redirect via backslash in and useNavigate CVE-2025-68470 bypass vulnerability discovered by ? in WordPress Npm react-router versions = 6.0.0, 7.18.0...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the navigation mechanisms when attacker-supplied paths containing a backslash are processed. An attacker can redirect users to unintended external sites by crafting malicious links or inputs. Remediation Upgrade...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the navigation mechanisms when attacker-supplied paths containing a backslash are processed. An attacker can redirect users to unintended external sites by crafting malicious links or inputs. Remediation Upgrade...

0beny1s (1.1.6), 0desgin (0.0.1) +15936 more potentially affected by CVE-2026-53669 via react-router (>=6.0.0, <=7.17.0)

react-router NPM version =6.0.0, =7.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on react-router and may be impacted: - 0beny1s 1.1.6 - 0desgin 0.0.1 - 0scarclassa 1.0.1 - 0scarclassb 1.0.1 - 0scarclassc 1.0.1 - 0scarclassd 1.0.1 - 0scarclasse 1.0...

NPM: React Router: Open redirect leading to XSS

NPM: React Router: Open redirect leading to XSS vulnerability discovered by ? in WordPress Npm react-router-dom versions = 6.30.2, = 6.30.4...

NPM: React Router: Open redirect leading to XSS

NPM: React Router: Open redirect leading to XSS vulnerability discovered by ? in WordPress Npm react-router versions = 7.9.6, = 7.12.0...

@accounter/client (>=0.0.8-alpha-20251116084105-a1cea854a8885090847180b84764d326dbe1ab77, <=0.0.10-alpha-20260124220016-4e2b62f7c68c0c6fd69aea71f714b37188ddd976), @boxyhq/react-ui (3.5.2) +64 more potentially affected by CVE-2026-53668 via react-router (>=7.9.6, <=7.12.0-pre.0)

react-router NPM version =7.9.6, =0.0.8-alpha-20251116084105-a1cea854a8885090847180b84764d326dbe1ab77, =1.0.1-MON-198407-add-selinux-sudo-check.0, =3.4.9, =0.1.9, =1.21.9, =1.21.9, =0.3.1, =1.5.0, =0.4.0, =0.0.5, =0.0.7 and more Source cves: CVE-2026-53668 Source advisory:...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the redirect. An attacker can cause users to be redirected to malicious external sites or execute unauthorized scripts by enticing them to click crafted links. Remediation Upgrade react-router to version 7.13.0 or...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the redirect. An attacker can cause users to be redirected to malicious external sites or execute unauthorized scripts by enticing them to click crafted links. Remediation Upgrade org.webjars.npm:react-router to versio...

@0xmike/web-kit (>=0.0.6, <=0.1.1), @acmekit/acmekit (>=2.13.1, <=2.13.94) +284 more potentially affected by CVE-2026-53668 via react-router-dom (>=6.30.2, <=6.30.4)

react-router-dom NPM version =6.30.2, =0.0.6, =2.13.1, =2.13.1, =2.13.1, =2.13.1, =1.4.0, =0.0.1, =1.2.0, =0.1.0, =0.0.6, =2.0.1, =4.1.0 - @automattic/data-stores 3.2.2 - @automattic/domain-search 1.1.0 - @automattic/jetpack-ai-calypso 2.1.0 and more Source cves: CVE-2026-53668 Source advisory:...

@accounter/client (>=0.0.8-alpha-20251116084105-a1cea854a8885090847180b84764d326dbe1ab77, <=0.0.10-alpha-20260124220016-4e2b62f7c68c0c6fd69aea71f714b37188ddd976), @boxyhq/react-ui (3.5.2) +64 more potentially affected by CVE-2026-53668 via react-router (>=7.9.6, <=7.12.0-pre.0)

react-router NPM version =7.9.6, =0.0.8-alpha-20251116084105-a1cea854a8885090847180b84764d326dbe1ab77, =1.0.1-MON-198407-add-selinux-sudo-check.0, =3.4.9, =0.1.9, =1.21.9, =1.21.9, =0.3.1, =1.5.0, =0.4.0, =0.0.5, =0.0.7 and more Source cves: CVE-2026-53668 Source advisory: OSV:GHSA-JJMJ-JMHJ-QWJ2...

React Router: Open redirect leading to XSS

Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors...

GHSA-JJMJ-JMHJ-QWJ2 React Router: Open redirect leading to XSS

Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors...

NPM: React Router: RSCErrorHandler Missing Protocol Validation (XSS)

NPM: React Router: RSCErrorHandler Missing Protocol Validation XSS vulnerability discovered by ? in WordPress Npm react-router versions = 7.11.0, 7.18.0...

GHSA-H8FP-F39C-Q6MH React Router: RSCErrorHandler Missing Protocol Validation (XSS)

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the unstable RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect...

@aaravpos/appointment-barber-booking (>=1.0.0, <=4.0.6), @aaravpos/appointment-booking-plugin (>=1.0.1, <=8.0.2) +265 more potentially affected by CVE-2026-53667 via react-router (>=7.11.0, <=7.17.0)

react-router NPM version =7.11.0, =1.0.0, =1.0.1, =0.0.9-alpha-20251217170854-13a5505369f22d85f29bcbbbe455c23672e2aca3, =1.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.127 and more Source...

@aaravpos/appointment-barber-booking (>=1.0.0, <=4.0.6), @aaravpos/appointment-booking-plugin (>=1.0.1, <=8.0.2) +265 more potentially affected by CVE-2026-53667 via react-router (>=7.11.0, <=7.17.0)

react-router NPM version =7.11.0, =1.0.0, =1.0.1, =0.0.9-alpha-20251217170854-13a5505369f22d85f29bcbbbe455c23672e2aca3, =1.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.127 and more Source...