CVE-2026-53667

mediumCVSS 6.9covered by 2 sourcesfirst seen 2026-07-23

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the (unstable) RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect targets [!NOTE] This only affects your application if you are using the unstable RSC APIs

⚡ Watch CVE-2026-53667

Get an email if CVE-2026-53667 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 28% of all EPSS-scored CVEs.

Advisory coverage (2)

mediumCVE-2026-53667: React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is …nvd · 2026-07-27
mediumGHSA-h8fp-f39c-q6mh: React Router: RSCErrorHandler Missing Protocol Validation (XSS)ghsa · 2026-07-23

External references

NVD record for CVE-2026-53667

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-53667 status](https://www.csirts.com/badge/CVE-2026-53667)](https://www.csirts.com/cve/CVE-2026-53667)