CVE-2025-68470: 
React Router vulnerability analysis and mitigation

CVE-2025-68470 is an open redirect vulnerability in React Router (npm package react-router) that allows an attacker-controlled path to cause a React Router application to perform an unexpected navigation or redirect to an external URL. It affects versions >=6.0.0 and <6.30.2, and >=7.0.0 and <7.9.6. The vulnerability was published on January 8, 2026, by researcher APshenkin via the GitHub Security Advisory GHSA-9jcx-v3wj-wh4m, and was added to the NVD on January 10, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, React Router Advisory).

The vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site / Open Redirect). When a React Router application passes untrusted, attacker-supplied content into navigation paths — via navigate(), <Link>, or redirect() — the router fails to properly validate or sanitize the path, allowing a crafted input to resolve as an absolute external URL rather than a relative internal route. Exploitation requires low privileges (an authenticated or otherwise privileged user context where untrusted input reaches navigation calls) and no user interaction beyond the application processing the malicious path. The vulnerability is only exploitable when developers pass untrusted content directly into navigation path arguments without prior sanitization (GitHub Advisory, React Router Advisory).

Successful exploitation enables an attacker to redirect users of a vulnerable React Router application to an arbitrary external URL, facilitating phishing attacks, credential harvesting, or malware distribution under the guise of a trusted application. The primary impact is on integrity (CVSS integrity: High), with no direct confidentiality or availability impact. Downstream IBM products incorporating React Router — including watsonx.data, IBM API Connect, IBM Business Automation Workflow, IBM Cloud Pak for Business Automation, and others — are also affected, broadening the potential attack surface across enterprise environments (GitHub Advisory, IBM watsonx Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.034% (10th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is conditional on the application passing untrusted input into React Router navigation APIs, limiting the attack surface to applications with this specific coding pattern (GitHub Advisory).

1. Identify a vulnerable application: Locate a React Router application (v6.0.0–6.30.1 or v7.0.0–7.9.5) that passes user-controlled or externally sourced data into navigate(), <Link to={...}>, or redirect() calls without sanitization.
2. Craft a malicious path: Construct a path string that React Router will interpret as an external URL rather than an internal route. Common techniques include using //evil.com/path (protocol-relative URL) or https://evil.com as the path value, which bypasses naive relative-path checks.
3. Deliver the payload: Supply the crafted path through any application input that feeds into the navigation call — for example, a URL query parameter, form field, or API response that the application uses as a redirect destination.
4. Trigger the redirect: When the application processes the input and calls the navigation API with the attacker-supplied path, React Router redirects the user's browser to the external attacker-controlled URL.
5. Achieve objective: The victim's browser lands on the attacker's site, enabling phishing, credential theft, or malware delivery under the appearance of a legitimate application redirect (React Router Advisory).

• Network: Unexpected HTTP 3xx redirect responses from the application pointing to external domains not in the application's known redirect allowlist; outbound browser navigations to external URLs immediately following user interaction with application navigation elements.
• Logs: Application server or CDN access logs showing navigation/redirect calls with path values containing //, https://, or other absolute URL patterns as the path argument; unusual referrer headers on external sites originating from the vulnerable application's domain.
• Application Behavior: Users reporting being unexpectedly redirected to external or unfamiliar websites after interacting with links or forms within the application.

Upgrade react-router to version 6.30.2 (for v6 users) or 7.9.6 (for v7 users), which contain the fix for this vulnerability. As a workaround where immediate upgrade is not possible, developers should validate and sanitize all untrusted input before passing it to navigate(), <Link>, or redirect() — specifically rejecting paths that begin with //, https://, http://, or other absolute URL patterns. IBM product users should apply the relevant iFixes and cumulative updates referenced in IBM's security bulletins for affected products including watsonx.data, IBM API Connect, IBM Business Automation Workflow, and IBM Cloud Pak for Business Automation (GitHub Advisory, IBM watsonx Advisory, IBM API Connect).

The Belgium Centre for Cybersecurity (CCB) issued a warning advising organizations to patch React Router immediately due to high-severity vulnerabilities including CVE-2025-68470. Security community coverage noted the vulnerability alongside other React Router flaws disclosed around the same period, with outlets such as Security Online and Purple Ops highlighting the broader React Router security advisory cluster. IBM issued multiple security bulletins across its product portfolio acknowledging the vulnerability's impact on enterprise products (CCB Advisory, Security Online, IBM watsonx Advisory).