Medium severity · published Jan 10, 2026
CVE-2025-68470
React Router has unexpected external redirect via untrusted paths
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate(), <Link>, or redirect(), the app performs a navigation/redirect to an external URL. This is only an issue if you are passing untrusted content into navigation paths in your application code. This issue has been patched in versions 6.30.2 and 7.9.6.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
react-router · remix-run
>= 7.0.0, < 7.9.6; >= 6.0.0, < 6.30.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-68470
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-68470
Third Party Advisory
https://github.com/remix-run/react-router/security/advisories/GHSA-9jcx-v3wj-wh4m
More from react-router
9.1
CVE-2025-61686
React Router has Path Traversal in File Session Storage
8.2
CVE-2026-21884
React Router SSR XSS in ScrollRestoration
8.1
CVE-2026-42211
React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
7.6
CVE-2025-59057
React Router has XSS Vulnerability
7.5
CVE-2026-55685
React Router: Unauthenticated Denial of Service via Inefficient Route Matching