Executive brief
React Router is a JavaScript library that enables client-side navigation in web applications. A vulnerability in the routing logic allows applications that use untrusted user-supplied data in navigation operations to unexpectedly redirect users to external websites. An attacker could exploit this by injecting malicious paths into the application, causing victim users to be redirected away from the legitimate application to attacker-controlled sites for phishing or credential theft.
Technical details
The vulnerability is an open redirect (CWE-601) in React Router's path handling logic. When an application passes untrusted content into navigation functions such as navigate(), the <Link> component, or redirect(), an attacker can craft a specially-formed path that causes the application to navigate to an external URL instead of an internal route. The attack requires that the application developer passes attacker-controlled data directly into navigation paths without proper validation. Network-accessible applications using vulnerable versions (6.0.0–6.30.1 or 7.0.0–7.9.5) and accepting user-controlled routing parameters are affected. Patches are available in versions 6.30.2 and 7.9.6 or later.
Affected products
- Remix React Router 6.0.0 to 6.30.1, 7.0.0 to 7.9.5
Timeline
- 2026-01-08: disclosed: GHSA-9jcx-v3wj-wh4m published
- 2026-01-08: patched: Fixes released in versions 6.30.2 and 7.9.6