Is there a public PoC exploit available for CVE-2026-40181?

Yes, a public proof-of-concept exploit is available for CVE-2026-40181. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-40181?

Yes, a patch is available for CVE-2026-40181. Update the affected software to the latest version immediately.

React Router CVE-2026-40181

Q: What is the CVSS score of CVE-2026-40181?

CVE-2026-40181 has a CVSS 4.0 base score of 6.6 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

Q: Which versions of React Router are affected by CVE-2026-40181?

Open redirect in React Router's programmatic `redirect()` function allows unauthenticated remote attackers to redirect users to arbitrary external domains by supplying path values beginning with…. A patch is available.

EUVD-2026-33996 MEDIUM

URL Redirection to Untrusted Site (Open Redirect) (CWE-601)

2026-06-02 GitHub_M

GHSA-2j2x-hqr9-3h42

Open Redirect React Router

6.6

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.6 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Red Hat

5.4 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 02, 2026 - 21:02 EUVD

Analysis Generated

Jun 02, 2026 - 20:30 vuln.today

CVSS changed

Jun 02, 2026 - 20:22 NVD

6.6 (MEDIUM)

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

56 npm packages depend on @remix-run/router (7 direct, 49 indirect)
7 npm packages depend on react-router (3 direct, 4 indirect)

Ecosystem-wide dependent count for version 1.3.0 and other introduced versions.

DescriptionCVE.org

React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs. The level of impact depends on the validation done by the application prior to returning the redirect. This does not impact applications using Declarative Mode (<BrowserRouter>). This is patched in versions 7.14.1 and 6.30.4.

AnalysisAI

Open redirect in React Router's programmatic redirect() function allows unauthenticated remote attackers to redirect users to arbitrary external domains by supplying path values beginning with //, which browsers interpret as protocol-relative (scheme-relative) URLs. Affected are applications in the v7 series (7.0.0-7.14.0) and v6 series (6.7.0-6.30.3) that expose user-influenced input to redirect() without validating the path prefix. No public exploit identified at time of analysis - CVSS 4.0 supplemental metric E:U (Unreported) confirms no known active exploitation - but the technique is trivially constructible from the advisory description alone, and patched releases 7.14.1 and 6.30.4 are available.

Technical ContextAI

React Router (cpe:2.3:a:remix-run:react-router:*:*:*:*:*:*:*:*) is a widely deployed client-side and server-side routing library for React applications, maintained under the remix-run GitHub organization. The flaw exists in the programmatic redirect() helper API. Under RFC 3986, a URI reference beginning with // is a protocol-relative (scheme-relative) reference - browsers resolve it by prepending the current page's scheme (e.g., https:), treating //evil.com as https://evil.com. React Router does not canonicalize or reject path arguments that carry this prefix before issuing the HTTP redirect response, enabling the browser to navigate to an entirely attacker-controlled origin. This is a textbook CWE-601 (URL Redirection to Untrusted Site / Open Redirect) root cause. Critically, the flaw is scoped exclusively to the programmatic redirect() API; applications using only Declarative Mode (<BrowserRouter> with JSX route definitions) perform no equivalent server-side redirect dispatch and are explicitly unaffected per the advisory.

RemediationAI

Vendor-released patches are available: upgrade to React Router 7.14.1 for v7 installations or 6.30.4 for v6 installations - these are the confirmed fix versions per the GitHub Security Advisory GHSA-2j2x-hqr9-3h42. If an immediate upgrade cannot be scheduled, the primary compensating control is application-level input validation: before passing any user-influenced value to redirect(), strip or reject path strings beginning with // or containing a scheme delimiter (e.g., ://). A strict destination allowlist - permitting only known-safe relative paths or explicitly enumerated absolute URLs - is the most robust workaround and avoids the pitfall of incomplete prefix-stripping heuristics. Note that this validation must be implemented in application code, not the library, as React Router performs no canonicalization prior to redirect dispatch. Side effect: overly aggressive sanitization of // prefixes could inadvertently interfere with legitimate protocol-relative asset references if those strings flow through the same code path - scope the validation narrowly to redirect destinations.

More in Open Redirect

View all

CVE-2017-1000117 HIGH Act Now POC

8.8 Oct 05

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca

CVE-2024-52875 HIGH Act Now POC

8.8 Jan 31

GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of

CVE-2016-5385 HIGH Act Now POC

8.1 Jul 19

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect

CVE-2013-2248 MEDIUM This Month POC

5.8 Jul 20

Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to

CVE-2012-6499 MEDIUM This Month POC

5.8 Jan 12

Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows

CVE-2015-2863 MEDIUM This Month POC

4.3 Jul 20

Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b

CVE-2017-3528 MEDIUM This Month POC

5.4 Apr 24

Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li

CVE-2012-0518 MEDIUM Act Now

4.7 Oct 16

Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3

CVE-2024-21641 MEDIUM This Month POC

6.5 Jan 05

Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp

CVE-2015-5354 MEDIUM This Month POC

5.8 Jul 01

Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites

CVE-2015-5461 MEDIUM This Month POC

6.4 Jul 08

Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for

CVE-2024-22891 CRITICAL Act Now POC

9.8 Mar 01

Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit

Same weakness CWE-601 – URL Redirection to Untrusted Site (Open Redirect)

View all

CVE-2017-1000117 HIGH POC

8.8

CVE-2016-5385 HIGH POC

8.1

CVE-2017-3528 MEDIUM POC

5.4

CVE-2012-0518 MEDIUM

4.7

CVE-2024-21641 MEDIUM POC

6.5

CVE-2015-5354 MEDIUM POC

5.8

CVE-2024-22891 CRITICAL POC

9.8

CVE-2022-40083 CRITICAL POC

9.6

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed
SUSE Linux Enterprise Module for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Server 16.0	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Server for SAP applications 16.0	Fixed

CVE-2026-40181 vulnerability details – vuln.today

Back

React Router CVE-2026-40181

Severity by source

CVSS VectorVendor: GitHub_M

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Open Redirect

Same weakness CWE-601 – URL Redirection to Untrusted Site (Open Redirect)

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code