« Volver al listado

CVE-2025-68470

Estado: AnalizadaMedia (6.5)—

React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate(), <Link>, or redirect(), the app performs a navigation/redirect to an external URL. This is only an issue if you are passing untrusted content into navigation paths in your application code. This issue has been patched in versions 6.30.2 and 7.9.6.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Shopify — React-router

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-68470",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-68470",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-12T18:17:37.258808Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "remix-run",
          "product": "react-router",
          "versions": [
            {
              "status": "affected",
              "version": ">= 7.0.0, < 7.9.6"
            },
            {
              "status": "affected",
              "version": ">= 6.0.0, < 6.30.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-01-10T03:15:48.477",
  "references": [
    {
      "url": "https://github.com/remix-run/react-router/security/advisories/GHSA-9jcx-v3wj-wh4m",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate(), <Link>, or redirect(), the app performs a navigation/redirect to an external URL. This is only an issue if you are passing untrusted content into navigation paths in your application code. This issue has been patched in versions 6.30.2 and 7.9.6."
    },
    {
      "lang": "es",
      "value": "React Router es un router para React. En las versiones 6.0.0 a 6.30.1 y 7.0.0 a 7.9.5, una ruta proporcionada por un atacante puede ser diseñada de modo que cuando una aplicación de React Router navega a ella a través de navigate(), , o redirect(), la aplicación realiza una navegación/redirección a una URL externa. Esto es solo un problema si está pasando contenido no confiable a rutas de navegación en el código de su aplicación. Este problema ha sido parcheado en las versiones 6.30.2 y 7.9.6."
    }
  ],
  "lastModified": "2026-06-17T09:59:06.990",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FFF65931-3D66-4739-BFC7-9632E04CFBD6",
              "versionEndIncluding": "6.30.1",
              "versionStartIncluding": "6.0.0"
            },
            {
              "criteria": "cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7460DDBE-CAD6-4AD1-A8CF-334FBB977ABE",
              "versionEndIncluding": "7.9.5",
              "versionStartIncluding": "7.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}