PT-2025-42375 · Reflex · Reflex

Published 2025-10-15 · Updated 2025-10-16 · CVE-2025-62379

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Reflex versions 0.5.4 through 0.8.14

Description Reflex is a library used to build full-stack web applications in Python. Versions 0.5.4 through 0.8.14 contain an issue in the /auth-codespace endpoint where the redirect to query parameter value is assigned directly to client-side links without validation. This can lead to automatic clicks and redirection of users to arbitrary external URLs when the application is running in a GitHub Codespaces environment. The vulnerability is triggered when the GITHUB CODESPACES PORT FORWARDING DOMAIN environment variable is set. The code assigns the redirect to query parameter to a.href without validation, triggering immediate navigation to an external domain. The execution depends on a sessionStorage flag, activating on first visits or in incognito mode.

Recommendations Update to version 0.8.15 or later. Ensure that the GITHUB CODESPACES PORT FORWARDING DOMAIN environment variable is not set in a production environment.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-62379

GHSA-RFH5-C9H5-Q8JM

Affected Products

Reflex

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62379.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-62379 · Security Note
• https://osv.dev/vulnerability/GHSA-rfh5-c9h5-q8jm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62379 · Vendor Advisory
• https://github.com/reflex-dev/reflex/blob/51f9f2c2f52cac4d66c07683a12bc0237311b6be/reflex/utils/codespaces.py#L18-L46 · Note
• https://github.com/reflex-dev/reflex · Note
• https://github.com/reflex-dev/reflex/commit/ade12549f3c0ddab3d7382c581bc04a3c1f989ec · Note
• https://github.com/reflex-dev/reflex/security/advisories/GHSA-rfh5-c9h5-q8jm · Note
• https://t.me/cveNotify/138804 · Telegram Post
• https://t.me/CVEtracker/35019 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1o87w9u/resumen_diario_de_vulnerabilidades_16102025 · Reddit Post
• https://file.notion.so/f/f/d105d145-04bc-45c5-b46c-ed880895e9de/a86c3e3b-f67f-45d1-8fa2-4aa0ba7d0068/poc.mp4?table=block&id=26955717-5d2e-805a-b53c-e25ee03f1d4b&spaceId=d105d145-04bc-45c5-b46c-ed880895e9de&expirationTimestamp=1760508000000&signature=ZPp8PVldfGOh0gB5tVElRV6GN789R-EG0oxZgkFjjLU&downloadName=poc.mp4 · Note
• https://twitter.com/CVEnew/status/1978545042244653175 · Twitter Post