React Router External Redirect Vulnerability via Untrusted Paths

A vulnerability in React Router allows for unexpected navigation to external URLs. This issue affects versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5. The vulnerability arises when an attacker crafts a path that, when used with the navigate() function, <Link> component, or redirect() method, redirects the application to an external site. This problem occurs only if untrusted content is injected into the navigation paths within the application.

Impact

Exploitation of this vulnerability could lead to unauthorized redirection of users to external websites, potentially causing phishing or other malicious activities.

Remediation

Users can upgrade to React Router versions 6.30.2 or 7.9.6 to address this vulnerability.