Skip to content
VulniPulse
Sign in
Highest advisory severityMedium 1 vendor · 1 advisory

CVE-2026-53668

CVE-2026-53668: 1 tracked advisory record across Red Hat. Compare source-reported impact, fixes and remediation.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Red Hat

1 advisory
  • Advisory severityMedium6.9

    Medium [CVE-2026-53668] Cross-Site Scripting (XSS) via open redirects

    CVE-2026-53668Source published Source updated

    React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector. This issue has been fixed in version 7.13.0. In addition to the redirect itself, a crafted target URL can be used to achieve Cross-Site Scripting (XSS) against the vulnerable application, potentially exposing session data or allowing unauthorized actions in the context of the redirecting origin. Red Hat's CVSS score (6.9, AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N) matches the upstream/CVE.org self-assigned score exactly, so no Red Hat-specific re-scoring was applied. Red Hat severity: Moderate — CVSS 6.9…

    Affected products in this advisory
    • Cryostat 4
    • Migration Toolkit for Virtualization
    • Multicluster Engine for Kubernetes
    • OpenShift Lightspeed

    16 more entries in the full advisory.

    Source-reported affected versions
    • 6.30.2
    • 6.30.4
    • 7.9.6
    • 7.12.0
    Source-reported fixed versions
    • 7.13.0
    Mitigation guidance
    • There is no mitigation available other than upgrading to react-router/react-router-dom 7.13.0 or later once the fix is packaged in the affected Red Hat products. As a defense-in-depth measure independent of this specific flaw, applications should always validate redirect targets against an allow-list of internal/trusted destinations before passing them to React Router's navigation or redirect APIs, rather than redirecting directly to caller-supplied URLs.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Monitor future Red Hat CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features