VulnSocial

CVE-2026-53666Disclosure(shopify / react-router)

LOWCVSS 6.1 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on the client, which would in turn trigger an outbound network request. This is only possible with very specific (and unlikely) application-layer code. Note that this does not impact an application if it is using Declarative Mode. It only impacts Framework Mode and Data Mode applications that perform manual SSR/hydration. This issue has been fixed in version 7.18.0.

shopify CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-470

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • react-router

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
shopify
Products
react-router

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-07-28: 2Technical Details · 2026-07-28: 107-28
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    General

    🚨*CVE* CVE-2026-53666 React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certai… https://www.cve.org/CVERecord?id=CVE-2026-53666 ----- Traducción: CVE-2026-53666 Rea… http://infoflow.cloud`

    Post summary

    The post simply announces CVE-2026-53666 and mentions a potential flaw in React Router, but provides no further technical or exploit information.

    0000033
    95 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-53666 React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certai… https://www.cve.org/CVERecord?id=CVE-2026-53666

    Post summary

    CVE-2026-53666, affecting React Router versions 6.4.0 through 7.17.0, has been disclosed with a description of how attacker‑supplied input can overwrite application data. No PoC, exploit tool, or patch is referenced in the brief mention.

    00000880
    57.9K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appshopifyreact-router-node.js-

Explore more

Back to dashboardshopify CVEsreact-router vulnerabilities