CVE-2026-53669

mediumcovered by 2 sourcesfirst seen 2026-07-23

This is a follow up to CVE-2025-68470. React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations.

⚡ Watch CVE-2026-53669

Get an email if CVE-2026-53669 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.49% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 40% of all EPSS-scored CVEs.

Advisory coverage (2)

unknownCVE-2026-53669: React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redir…nvd · 2026-07-27
mediumGHSA-wrjc-x8rr-h8h6: React Router: Open redirect via backslash in and useNavigate (CVE-2025-68470 bypass)ghsa · 2026-07-23

External references

NVD record for CVE-2026-53669

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-53669 status](https://www.csirts.com/badge/CVE-2026-53669)](https://www.csirts.com/cve/CVE-2026-53669)