GHSA-9jcx-v3wj-wh4m
React Router has unexpected external redirect via untrusted paths
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | react-router | >= 6.0.0, < 6.30.2 | 6.30.2 |
| npm | react-router | >= 7.0.0, < 7.9.6 | 7.9.6 |
Details
As written in the advisory (Markdown source, shown as plain text).
An attacker-supplied path can be crafted so that when a React Router application navigates to it via `navigate()`, `<Link>`, or `redirect()`, the app performs a navigation/redirect to an external URL. This is only an issue if developers pass untrusted content into navigation paths in their application code.
References
External links from the advisory. They lead to third-party sites.