Описание
A flaw was found in React Router. Applications using React Router that allow open redirects are vulnerable to Cross-Site Scripting (XSS). A remote attacker could craft a malicious link that, when clicked by a user, redirects them to an unexpected external site or exploits an XSS vulnerability, potentially leading to information disclosure or unauthorized actions.
Отчет
React Router (npm packages react-router and react-router-dom) versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0 contain an open redirect flaw. Applications that use React Router's navigation APIs (for example Navigate, redirect(), or loader/action responses) to redirect users to a URL derived from untrusted input, without validating that the target is an allow-listed internal or trusted destination, can be made to redirect a victim to an attacker-controlled site. In addition to the redirect itself, a crafted target URL can be used to achieve Cross-Site Scripting (XSS) against the vulnerable application, potentially exposing session data or allowing unauthorized actions in the context of the redirecting origin. This issue is fixed upstream in react-router/react-router-dom 7.13.0. This flaw is only reachable in Red Hat products that both bundle an affected version of react-router/react-router-dom in a web console or UI component AND implement an open redirect pattern (redirecting to a caller-supplied or otherwise untrusted URL) in that component's own routing code. Simply bundling react-router as a dependency does not by itself make a product exploitable; each console/UI must be independently assessed by its owning component team for whether it constructs redirects from untrusted input. Red Hat's CVSS score (6.9, AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N) matches the upstream/CVE.org self-assigned score exactly, so no Red Hat-specific re-scoring was applied. For comparison, a related but distinct prior React Router open-redirect-to-XSS flaw (CVE-2026-22029) was scored higher by Red Hat (8.0, Important) with Integrity High rather than Low; that difference is consistent with the upstream advisories describing different underlying primitives, and Red Hat's score here mirrors the vendor's own (lower) assessment of this specific issue's integrity impact.
Меры по смягчению последствий
There is no mitigation available other than upgrading to react-router/react-router-dom 7.13.0 or later once the fix is packaged in the affected Red Hat products. As a defense-in-depth measure independent of this specific flaw, applications should always validate redirect targets against an allow-list of internal/trusted destinations before passing them to React Router's navigation or redirect APIs, rather than redirecting directly to caller-supplied URLs.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| A-MQ Interconnect 1 | qpid-dispatch | Not affected | ||
| Cryostat 4 | cryostat-openshift-console-plugin-npm | Not affected | ||
| Cryostat 4 | grafana-infinity-datasource-npm | Fix deferred | ||
| Cryostat 4 | react-router | Not affected | ||
| Cryostat 4 | react-router-dom | Fix deferred | ||
| Exploit Intelligence | exploit-intelligence-tech-preview/agent-client-rhel9 | Not affected | ||
| Gatekeeper 3 | gatekeeper/gatekeeper-rhel9 | Not affected | ||
| Migration Toolkit for Applications 8 | mta/mta-ui-rhel8 | Not affected | ||
| Migration Toolkit for Applications 8 | mta/mta-ui-rhel9 | Not affected | ||
| Migration Toolkit for Containers | rhmtc/openshift-migration-ui-rhel8 | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
6.9 Medium
CVSS3
Связанные уязвимости
React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.
EPSS
6.9 Medium
CVSS3