CVE-2025-68470
Last modified
CVE-2025-68470 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate(), <Link>, or redirect(), the app performs a navigation/redirect to an external URL. EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate(), <Link>, or redirect(), the app performs a navigation/redirect to an external URL. This is only an issue if you are passing untrusted content into navigation paths in your application code. This issue has been patched in versions 6.30.2 and 7.9.6.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Shopify | React-Router | >= 6.0.0, <= 6.30.1 |
| Shopify | React-Router | >= 7.0.0, <= 7.9.5 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-68470?
How severe is CVE-2025-68470?
How do I fix CVE-2025-68470?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-68462Freedombox before 25.17.1 does not set proper permissions fo…3.2
- CVE-2025-68463Bio.Entrez in Biopython through 186 allows doctype XXE.4.9
- CVE-2025-68467Dark Reader is an accessibility browser extension that makes…3.4
- CVE-2025-68468Avahi is a system which facilitates service discovery on a l…6.5
- CVE-2025-68469ImageMagick is free and open-source software used for editin…3.3
- CVE-2025-6847A vulnerability classified as critical was found in code-pro…9.8
- CVE-2025-68471Avahi is a system which facilitates service discovery on a l…6.5
- CVE-2025-68472MindsDB is a platform for building artificial intelligence f…9.1
- CVE-2025-68473ESF-IDF is the Espressif Internet of Things (IOT) Developmen…8.6
- CVE-2025-68474ESF-IDF is the Espressif Internet of Things (IOT) Developmen…7.6
- CVE-2025-68475Fedify is a TypeScript library for building federated server…7.5
- CVE-2025-68476KEDA is a Kubernetes-based Event Driven Autoscaling componen…8.2
Are you affected by CVE-2025-68470?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST