PT-2026-45832 · Unknown · React Router
CVSS v4.0
6.6
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U |
Name of the Vulnerable Software and Affected Versions
React Router versions 6.7.0 through 6.30.3
React Router versions 7.0.0 through 7.14.0
Description
Certain URLs passed to the
redirect() function can trigger an open redirect to an external domain. This occurs because path values starting with // are reinterpreted as protocol-relative URLs, which are URLs that inherit the protocol (HTTP or HTTPS) of the current page. The impact depends on the validation performed by the application before the redirect is returned. This issue does not affect applications using Declarative Mode (<BrowserRouter>).Recommendations
Update to version 6.30.4 for versions 6.7.0 through 6.30.3.
Update to version 7.14.1 for versions 7.0.0 through 7.14.0.
Exploit
Fix
Open Redirect
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
React Router