MEDIUM 6.5 npm
React Router has unexpected external redirect via untrusted paths
GHSA-9jcx-v3wj-wh4m · CVE-2025-68470
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
An attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate(), <Link>, or redirect(), the app performs a navigation/redirect to an external URL. This is only an issue if developers pass untrusted content into navigation paths in their application code.
Ready to move
Start Securing
Free, no credit card | First findings in minutes