{"action":"Upgrade react-router to 7.18.0 or later.","affected":[{"fixed":"7.18.0","introduced":"7.11.0"}],"component":"react-router","cve_ids":["CVE-2026-53667"],"ecosystem":"npm","epss":0.00355,"exploited":false,"fixed_versions":["7.18.0"],"ghsa_id":"GHSA-h8fp-f39c-q6mh","id":"tcs_01M5KFTHMC2TDXJ2DYAA7Q57ES","modified_at":"2026-09-10T03:50:52.323492500Z","published_at":"2026-07-23T19:35:57Z","references":["https://osv.dev/vulnerability/GHSA-h8fp-f39c-q6mh","https://github.com/remix-run/react-router/security/advisories/GHSA-h8fp-f39c-q6mh","https://github.com/remix-run/react-router/pull/15177","https://github.com/remix-run/react-router/commit/ce596e823f0d7b883a433af1d5a839a8b9fe0242","https://github.com/remix-run/react-router","https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180","https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0"],"severity":{"label":"medium","score":6.9},"sources":[{"source":"osv","source_id":"GHSA-h8fp-f39c-q6mh","url":"https://osv.dev/vulnerability/GHSA-h8fp-f39c-q6mh"}],"summary":"React Router: RSCErrorHandler Missing Protocol Validation (XSS)"}