Listen to this Post
How the Mentioned CVE Works
This vulnerability exists in the path processing logic of React Router’s navigation functions (navigate(), <Link>, redirect()). When these functions receive an untrusted, user-supplied input string as the destination path, they fail to properly validate if the path constitutes an external URL. A malicious actor can craft a path beginning with a protocol scheme like https://malicious.com` or using protocol-relative URLs like//evil.com`. The router’s internal mechanism incorrectly interprets this as a valid internal navigation target. Instead of rejecting or sanitizing the input, the router triggers a client-side navigation event. This causes the user’s browser to leave the current application’s origin and redirect to the attacker-controlled external domain, facilitating phishing attacks or open redirects. The exploitation relies entirely on developers passing unsanitized user input directly to navigation hooks or components.
dailycve form
Platform: React Router
Version: >=6.0.0 <6.30.2
Vulnerability: External Redirect
Severity: Moderate
Date: 2026-01-08
Prediction: 2026-01-10
What Undercode Say:
$ npm list react-router $ grep -r "navigate(userInput)" src/
// Proof-of-Concept Code const maliciousInput = "https://phish.com"; navigate(maliciousInput); // Triggers external redirect
How Exploit:
Crafted malicious path parameter sent to vulnerable `navigate()` or `` prop.
Protection from this CVE
Update to patched versions (6.30.2, 7.9.6). Sanitize all user inputs before passing them to navigation functions. Implement allow-lists for internal paths.
Impact:
Open redirect, phishing attacks, user session compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
