CVE-2025-68470

Name of the Vulnerable Software and Affected Versions React Router versions 6.0.0 through 6.30.1 React Router versions 7.0.0 through 7.9.5

Description An attacker-supplied path can be crafted to force a React Router application to perform a navigation or redirect to an external URL. This occurs when the application navigates using the navigate() function, the <Link> component, or the redirect() function. This issue is only applicable if untrusted content is passed into navigation paths within the application code.

Recommendations Update to version 6.30.2 or later. Update to version 7.9.6 or later.