Vulnerability Description
React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate(), <Link>, or redirect(), the app performs a navigation/redirect to an external URL. This is only an issue if you are passing untrusted content into navigation paths in your application code. This issue has been patched in versions 6.30.2 and 7.9.6.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Shopify | React-Router | >= 6.0.0, <= 6.30.1 |
Related Weaknesses (CWE)
References
- https://github.com/remix-run/react-router/security/advisories/GHSA-9jcx-v3wj-wh4Third Party Advisory
FAQ
What is CVE-2025-68470?
CVE-2025-68470 is a vulnerability with a CVSS score of 6.5 (MEDIUM). React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Router application navigates to it via navig...
How severe is CVE-2025-68470?
CVE-2025-68470 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-68470?
Check the references section above for vendor advisories and patch information. Affected products include: Shopify React-Router.