CVE-2025-68470

React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate(), <Link>, or redirect(), the app performs a navigation/redirect to an external URL. This is only an issue if you are passing untrusted content into navigation paths in your application code. This issue has been patched in versions 6.30.2 and 7.9.6.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/remix-run/react-router/security/advisories/GHSA-9jcx-v3wj-wh4m	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:shopify:react-router::::::node.js::*
	cpe:2.3:a:shopify:react-router::::::node.js::*

History

17 Jun 2026, 09:59

Type	Values Removed	Values Added
Summary		(es) React Router es un router para React. En las versiones 6.0.0 a 6.30.1 y 7.0.0 a 7.9.5, una ruta proporcionada por un atacante puede ser diseñada de modo que cuando una aplicación de React Router navega a ella a través de navigate(), , o redirect(), la aplicación realiza una navegación/redirección a una URL externa. Esto es solo un problema si está pasando contenido no confiable a rutas de navegación en el código de su aplicación. Este problema ha sido parcheado en las versiones 6.30.2 y 7.9.6.

30 Jan 2026, 18:20

Type	Values Removed	Values Added
CPE		cpe:2.3:a:shopify:react-router::::::node.js::*
First Time		Shopify Shopify react-router
References	~~() https://github.com/remix-run/react-router/security/advisories/GHSA-9jcx-v3wj-wh4m -~~	() https://github.com/remix-run/react-router/security/advisories/GHSA-9jcx-v3wj-wh4m - Third Party Advisory

10 Jan 2026, 03:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-10 03:15

Updated : 2026-06-17 09:59

NVD link : CVE-2025-68470

Mitre link : CVE-2025-68470

CVE.ORG link : CVE-2025-68470

JSON object : View

Products Affected

shopify

react-router

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2025-68470", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-68470", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-12T18:17:37.258808Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "remix-run", "product": "react-router", "versions": [{"status": "affected", "version": ">= 7.0.0, < 7.9.6"}, {"status": "affected", "version": ">= 6.0.0, < 6.30.2"}]}]}], "published": "2026-01-10T03:15:48.477", "references": [{"url": "https://github.com/remix-run/react-router/security/advisories/GHSA-9jcx-v3wj-wh4m", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate(), <Link>, or redirect(), the app performs a navigation/redirect to an external URL. This is only an issue if you are passing untrusted content into navigation paths in your application code. This issue has been patched in versions 6.30.2 and 7.9.6."}, {"lang": "es", "value": "React Router es un router para React. En las versiones 6.0.0 a 6.30.1 y 7.0.0 a 7.9.5, una ruta proporcionada por un atacante puede ser dise\u00f1ada de modo que cuando una aplicaci\u00f3n de React Router navega a ella a trav\u00e9s de navigate(), , o redirect(), la aplicaci\u00f3n realiza una navegaci\u00f3n/redirecci\u00f3n a una URL externa. Esto es solo un problema si est\u00e1 pasando contenido no confiable a rutas de navegaci\u00f3n en el c\u00f3digo de su aplicaci\u00f3n. Este problema ha sido parcheado en las versiones 6.30.2 y 7.9.6."}], "lastModified": "2026-06-17T09:59:06.990", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "FFF65931-3D66-4739-BFC7-9632E04CFBD6", "versionEndIncluding": "6.30.1", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "7460DDBE-CAD6-4AD1-A8CF-334FBB977ABE", "versionEndIncluding": "7.9.5", "versionStartIncluding": "7.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}