This vulnerability (CVE-2026-53669) exists in React Router used in Red Hat Hardened Images RPMs, specifically in prometheus3.13 versions before 3.13.1-0.5.hum1. The flaw allows a remote attacker to craft malicious links containing backslashes within navigation components (Link or useNavigate), resulting in an open redirect. This can redirect users to arbitrary external websites, potentially enabling phishing attacks. The vulnerability is classified under CWE-601 (URL Redirection to Untrusted Site). Red Hat has released updated RPMs (prometheus3.13-3.13.1-0.5.hum1) to fix this issue.

The open redirect vulnerability allows attackers to redirect users to untrusted external websites, which can be used for phishing attacks. Users may be tricked into visiting malicious sites that appear legitimate, potentially leading to credential theft or exposure to malware. The vulnerability does not directly compromise confidentiality, integrity, or availability of the affected software but poses a significant risk to end users through social engineering.

Red Hat has released updated RPM packages (prometheus3.13-3.13.1-0.5.hum1) that fix this vulnerability. Users should apply these updates to their Red Hat Hardened Images to mitigate the risk. No alternative mitigations or workarounds are specified in the advisory. Patch status is confirmed by the vendor advisory.