CVE-2025-68470CWE-601

React Router has unexpected external redirect via untrusted paths

Medium · published January 10, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
41.4
In the wild
Unconfirmed
What it is

React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate(), <Link>, or redirect(), the app performs a navigation/redirect to an external URL. This is only an issue if you are passing untrusted content into navigation paths in your application code. This issue has been patched in versions 6.30.2 and 7.9.6.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00492 · 41.4th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-01-10T02:39Z
EPSS history
Timeline
  • 10 JAN 02:39Z
    React Router has unexpected external redirect via untrusted paths
    cvelistv5