CVE-2026-53669: 
Grafana vulnerability analysis and mitigation

CVE-2026-53669 is an open redirect vulnerability in React Router (npm package react-router) affecting versions 6.0.0 through 7.17.0. It allows unauthenticated attackers to craft malicious paths using backslashes in <Link> components and the useNavigate hook to trigger unexpected external navigations. This issue is a follow-up to CVE-2025-68470, where the original fix was found to be incomplete, leaving additional bypass scenarios unaddressed. It was disclosed on July 23, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Red Hat).

The root cause is improper URL normalization in React Router's navigation mechanisms, classified as CWE-601 (URL Redirection to Untrusted Site / Open Redirect). Specifically, the library failed to adequately sanitize backslash characters (\) in paths passed to <Link> and useNavigate, allowing them to be interpreted as external navigations by browsers. The fix in PR #15176 consolidated URL normalization logic into a centralized module (packages/react-router/lib/router/url.ts), introducing regex patterns (ABSOLUTE_URL_REGEX and PROTOCOL_RELATIVE_URL_REGEX) to detect and block protocol-relative and absolute URLs including those using backslash variants (\, \/, /\) (GitHub Advisory, GitHub PR #15176). No authentication or special privileges are required; user interaction (clicking a crafted link) is the only precondition.

Successful exploitation allows an unauthenticated attacker to redirect users from a trusted React application to an attacker-controlled external site, enabling phishing, credential harvesting, or malware delivery. The confidentiality and integrity impacts are low — the vulnerability does not directly expose server-side data or allow code execution — but it can undermine user trust and facilitate social engineering attacks. Availability is not affected (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The NVD SSVC assessment notes the vulnerability is automatable with partial technical impact and no known exploitation. The EPSS score is approximately 0.49%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage is available via Qualys (detection ID 151107) and Tenable plugins (Qualys, Tenable).

1. Identify target application: Locate a React application using react-router versions 6.0.0–7.17.0 that renders user-supplied or attacker-influenced paths in <Link> components or passes them to useNavigate.
2. Craft malicious path: Construct a path using backslash characters that browsers interpret as an external URL, e.g., \\evil.com or \/evil.com, which bypasses the incomplete validation from the CVE-2025-68470 fix.
3. Deliver the payload: Embed the crafted path in a link shared via phishing email, social media, or injected into application content (e.g., via a stored/reflected XSS vector or a URL parameter that populates a <Link> to prop).
4. User interaction: When a victim clicks the crafted link within the React application, the router resolves the backslash-prefixed path as an external navigation and redirects the browser to the attacker-controlled destination.
5. Achieve objective: The victim lands on a phishing page or malware-serving site, potentially leading to credential theft or further compromise (GitHub Advisory, GitHub PR #15176).

• Network: Outbound browser navigations to unexpected external domains originating from clicks within a React application; HTTP referrer headers from the application domain pointing to unrelated external sites.
• Logs: Web server or CDN access logs showing requests with paths containing backslash sequences (e.g., \\, \/, /\) in URL parameters or route values passed to navigation components.
• Application Monitoring: Client-side error tracking (e.g., Sentry) recording unexpected navigation events to external origins from within the React app's routing context.

The primary remediation is to upgrade react-router to version 7.18.0 or later, which consolidates URL normalization logic and correctly blocks backslash-based open redirect bypasses (GitHub Advisory, React Router v7.18.0 Release). As a workaround prior to patching, developers should audit all usages of <Link to={...}> and useNavigate(path) that accept user-supplied or externally derived path values, and implement strict allowlist-based path validation to ensure only internal routes are accepted. Red Hat has also issued errata (RHSA-2026:48780, RHSA-2026:48799) for affected downstream packages (Red Hat Errata).

Netlify published a changelog entry on July 23, 2026, acknowledging the React Router security vulnerabilities and advising users to update (Netlify Changelog). Red Hat tracked the issue via Bugzilla and issued security errata for affected products. The vulnerability was reported by a researcher credited as "outring" in the GitHub advisory. Community discussion on the fix PR noted a post-merge question about whether the updated regex intentionally allows certain mixed-slash patterns (//, \\, \/, /\), to which the maintainer confirmed it was intentional (GitHub PR #15176).