Medium [CVE-2026-53668] Cross-Site Scripting (XSS) via open redirects
This medium-severity Red Hat Linux advisory covers CVE-2026-53668 affecting Cryostat 4, Migration Toolkit for Virtualization, Multicluster Engine for Kubernetes.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS.
An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector. This issue has been fixed in version 7.13.0.
In addition to the redirect itself, a crafted target URL can be used to achieve Cross-Site Scripting (XSS) against the vulnerable application, potentially exposing session data or allowing unauthorized actions in the context of the redirecting origin.
Red Hat's CVSS score (6.9, AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N) matches the upstream/CVE.org self-assigned score exactly, so no Red Hat-specific re-scoring was applied. Red Hat severity: Moderate — CVSS 6.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N).
Weakness: CWE-601.
Affected products named by the advisory: Cryostat 4; Migration Toolkit for Virtualization; Multicluster Engine for Kubernetes; OpenShift Lightspeed; and 16 more.
- 6.30.2
- 6.30.4
- 7.9.6
- 7.12.0
Official advisory · high-confidence parse· fetched 12 days ago·verify at source
Mitigation checklist
- There is no mitigation available other than upgrading to react-router/react-router-dom 7.13.0 or later once the fix is packaged in the affected Red Hat products. As a defense-in-depth measure independent of this specific flaw, applications should always validate redirect targets against an allow-list of internal/trusted destinations before passing them to React Router's navigation or redirect APIs, rather than redirecting directly to caller-supplied URLs.
Official advisory · high-confidence parse· fetched 12 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.