React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

中 6.1CVE-2026-53669 · GHSA-wrjc-x8rr-h8h6 · 27/07/2026 公開 · 24/10/2026 更新

要点

CVE-2026-53669 は react-router (shopify), react-router に影響する深刻度「中」 (CVSS 6.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.32%（全脆弱性の 24.9% より高い）。
対処：7.18.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
react-router shopify	`≥ 6.0.0, < 7.18.0`	`7.18.0`
react-router npm	`≥ 6.0.0, < 7.18.0`	`7.18.0`

概要

This is a follow up to CVE-2025-68470. React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations.

NVD の説明

React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in <Link> and useNavigate. This issue is a follow up to CVE-2025-68470 and has been fixed in version 7.18.0.