PT-2026-1914 · Unknown · React Router

Published 2026-01-08 · Updated 2026-01-10 · CVE-2025-68470

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions React Router versions 6.0.0 through 6.30.1 React Router versions 7.0.0 through 7.9.5

Description A crafted path supplied by an attacker can cause a React Router application to navigate or redirect to an external URL when using navigate(), <Link>, or redirect(). This occurs when untrusted content is used in navigation paths within the application code.

Recommendations Update to React Router version 6.30.2 or later. Update to React Router version 7.9.6 or later.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-68470

GHSA-9JCX-V3WJ-WH4M

Affected Products

React Router

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68470.json · Exploit
• https://osv.dev/vulnerability/GHSA-9jcx-v3wj-wh4m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68470 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68470 · Security Note
• https://github.com/remix-run/react-router · Note
• https://github.com/remix-run/react-router/security/advisories/GHSA-9jcx-v3wj-wh4m · Note
• https://twitter.com/CVEnew/status/2009837434247201230 · Twitter Post