React
CVE-2025-68470
MEDIUM
GHSA-9jcx-v3wj-wh4m
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Redirect URL validation
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 6.5 (MEDIUM). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: None. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
React-Router versions up to 6.30.1 is affected by url redirection to untrusted site (open redirect) (CVSS 6.5).
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability (CWE-601: URL Redirection to Untrusted Site (Open Redirect)) affects React-Router. React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate(), <Link>, or redirect(), the app performs a navigation/redirect to an external URL. This is only an issue if you are passing untrusted content into navigation paths in your application code. This issue has been patched in versions 6.30.2 and 7.9.6.
Know when React gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate(), <Link>, or redirect(), the app performs a navigation/redirect to an external URL. This is only an issue if you are passing untrusted content into navigation paths in your application code. This issue has been patched in versions 6.30.2 and 7.9.6.
Blast Radius
ecosystem impact- 25 npm packages depend on react-router (7 direct, 19 indirect)
Ecosystem-wide dependent count for version 6.0.0.
Executive ViewAI
Organizations using versions 6.0.0 should be aware of notable risk from CVE-2025-68470 rated CVSS 6.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)GitHub Advisory
React Server Components in React 19.x contain a critical pre-authentication remote code execution vulnerability (CVE-202
Pre-authentication denial of service in React Server Components (versions 19.0.0 through 19.2.1) allows unauthenticated
Information disclosure in React Server Components 19.x, distributed as react-server-dom-webpack, react-server-dom-turbop
react-native-keys version 0.7.11 contains a sensitive information disclosure vulnerability where encryption ciphers and
Unsafe deserialization in React Server Components Server Function endpoints allows remote unauthenticated attackers to t
HTML injection in Preact and React through unsafe JSON deserialization allows remote attackers to inject arbitrary scrip
Reflected XSS in Repostat's RepoCard React component prior to version 1.0.1 allows attackers to execute arbitrary JavaSc
OS command injection in create-react-app's react-dev-utils component enables remote code execution on macOS developer wo
Refine's @refinedev/inferencer package through version 7.0.0 interpolates API field names straight into generated JSX so
Uncontrolled resource consumption in React Server Components (react-server-dom-parcel, react-server-dom-turbopack, react
Simple Membership (WordPress plugin) versions up to 4.7.0 contains a security vulnerability (CVSS 6.5).
Wekan is an open source kanban tool built with Meteor. [CVSS 6.5 MEDIUM]
Vendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Not-Affected |
| SUSE Linux Enterprise Server 16.0 | Not-Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Not-Affected |
| SUSE Manager Client Tools 15 | Not-Affected |
| SUSE Manager Client Tools for SLE 15 | Not-Affected |
| SUSE Multi-Linux Manager Client Tools for SLE 15 | Not-Affected |
| openSUSE Leap 16.0 | Not-Affected |
| SUSE Manager Proxy LTS 4.3 | Not-Affected |
| SUSE Manager Proxy Module 4.3 | Not-Affected |
| SUSE Enterprise Storage 6 | Not-Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Not-Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Not-Affected |
| SUSE Manager Proxy Module 4.1 | Not-Affected |
| SUSE Manager Proxy Module 4.2 | Not-Affected |
| openSUSE Leap 15.3 | Not-Affected |
| openSUSE Leap 15.4 | Not-Affected |
| openSUSE Leap 15.5 | Not-Affected |
| openSUSE Leap 15.6 | Not-Affected |
| SUSE Multi Linux Manager Tools SLE-15 | Not-Affected |
| ses/7.1/ceph/prometheus-server ses/7/ceph/prometheus-server suse/multi-linux-manager/5.2/x86_64/monitoring-prometheus | Not-Affected |
Exploit-DB