medium6.5
CVE-2025-68470
React Router has unexpected external redirect via untrusted paths
Impact
An attacker-supplied path can be crafted so that when a React Router application navigates to it via `navigate()`, `<Link>`, or `redirect()`, the app performs a navigation/redirect to an external URL. This is only an issue if developers pass untrusted content into navigation paths in their application code.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | react-router | >= 6.0.0, < 6.30.2 | 6.30.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Shopify | React-Router | from 6.0.0 through 6.30.1 from 7.0.0 through 7.9.5 |