GHSA-9jcx-v3wj-wh4m: React Router has unexpected external redirect via untrusted paths

Skip to content

Navigation Menu

• • AI CODE CREATION

    • GitHub CopilotWrite better code with AI

    • GitHub SparkBuild and deploy intelligent apps

    • GitHub ModelsManage and compare prompts

    • MCP RegistryNewIntegrate external tools

View all features

• Pricing

Provide feedback

Saved searches****Use saved searches to filter your results more quickly

Sign up

Appearance settings

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2025-68470

React Router has unexpected external redirect via untrusted paths

Moderate severity GitHub Reviewed Published Jan 8, 2026 in remix-run/react-router • Updated Jan 8, 2026

Package

npm react-router (npm)

Affected versions

>= 6.0.0, < 6.30.2

>= 7.0.0, < 7.9.6

Patched versions

6.30.2

7.9.6

Description

An attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate(), <Link>, or redirect(), the app performs a navigation/redirect to an external URL. This is only an issue if developers pass untrusted content into navigation paths in their application code.

References

• GHSA-9jcx-v3wj-wh4m

Published to the GitHub Advisory Database

Jan 8, 2026

EPSS score