CVE-2026-53667: 
React Router Analyse et atténuation des vulnérabilités

CVE-2026-53667 is a Cross-Site Scripting (XSS) vulnerability in the RSCErrorHandler component of React Router, caused by missing protocol validation in the unstable React Server Components (RSC) error handling path. Attackers can supply malicious redirect targets (e.g., using javascript: or about:blank protocols) that bypass validation and result in arbitrary JavaScript execution in the victim's browser. The vulnerability affects react-router npm package versions >= 7.11.0 and < 7.18.0, and was published on July 22–23, 2026. It carries a CVSS v3.1 base score of 6.9 (Moderate) (GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The RSCErrorHandler component in React Router's unstable RSC error handling path failed to validate the protocol of redirect locations sourced from untrusted server responses before using them in browser navigation (e.g., window.location.href). This is a follow-up to GHSA-8646-j5j9-6r62, where a prior redirect validation bypass was partially addressed but left a residual code path unprotected. The fix (PR #15177, commit ce596e8) introduced a hasInvalidProtocol() helper that checks redirect targets against a blocklist of dangerous protocols (including javascript:) across multiple RSC server and browser code paths (GitHub Advisory, Fix Commit). Exploitation requires user interaction (the victim must follow a crafted link or trigger a navigation) and high attack complexity, but no privileges are required from the attacker (GitHub Advisory).

Successful exploitation allows an unauthenticated network attacker to execute arbitrary JavaScript in the context of the victim's browser session, enabling session token theft, credential harvesting, or performing unauthorized actions on behalf of the user. Confidentiality impact is rated High (sensitive data exposure), integrity impact is Low, and there is no availability impact. The scope is changed, meaning the injected script can affect resources beyond the vulnerable component itself. This vulnerability only affects applications using React Router's unstable RSC APIs (GitHub Advisory).

1. Identify target: Locate a React Router application (versions 7.11.0–7.17.x) that uses the unstable RSC APIs, which can be inferred from public source code, npm package metadata, or application behavior.
2. Craft malicious redirect: Prepare a server-side response or manipulate an untrusted RSC data source to return a redirect payload with a dangerous protocol target, such as javascript:alert(document.cookie) or another javascript: URI.
3. Trigger RSC error handling path: Induce an error condition in the RSC rendering path (e.g., by causing a server component to throw a redirect response with the malicious location), so that RSCErrorHandler processes the attacker-controlled redirect target.
4. Victim interaction: Socially engineer the victim into navigating to the crafted page or link, triggering the RSC error handler to execute window.location.href = <attacker-controlled javascript: URI>.
5. Achieve XSS: The browser evaluates the javascript: URI, executing arbitrary JavaScript in the application's origin context, enabling session theft, DOM manipulation, or further attacks (GitHub Advisory, Fix Commit).

• Network: Unusual HTTP responses from RSC endpoints containing redirect locations with javascript:, about:, or other non-HTTP(S) protocols in the Location header or RSC payload.
• Logs: Server-side logs showing RSC error handler invocations with redirect targets containing unsupported protocol strings (e.g., javascript:, about:blank).
• Browser/Client: Unexpected JavaScript execution or alerts triggered during page navigation in React Router RSC-enabled applications; browser console errors related to invalid redirect locations.
• Application: Error boundary activations in RSC-enabled React Router apps coinciding with suspicious redirect payloads in network traffic.

Upgrade react-router to version 7.18.0 or later, which includes protocol validation for all RSC redirect code paths via the hasInvalidProtocol() helper (GitHub Advisory, v7.18.0 Release). If immediate patching is not possible, disable or avoid using the unstable RSC APIs entirely. As an additional defense-in-depth measure, implement server-side allowlisting of redirect destinations to restrict them to known-safe http:// or https:// URLs and validate all redirect targets before processing.

Netlify published a changelog entry on July 23, 2026 acknowledging the React Router security vulnerabilities, indicating awareness among hosting providers of the React ecosystem (Netlify Changelog). The fix was developed and merged by React Router maintainer brophdawg11 and released as part of v7.18.0. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified at this time.