-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| react-router | npm | >= 6.0.0, < 6.30.2 | 6.30.2 |
| react-router | npm | >= 7.0.0, < 7.9.6 | 7.9.6 |
Miggo AIRoot Cause AnalysisThe vulnerability is an open redirect caused by improper handling of paths starting with // in the resolvePath function. The provided patch for version 6.x of react-router shows that the logic in resolvePath was changed to normalize double slashes in paths. The vulnerable code snippet is the original implementation of resolvePath which does not handle this case, allowing a path like //google.com to be passed through, which the browser then interprets as an external URL. The fix involves replacing // with / to treat it as a root-relative path within the application.
resolvePathpackages/router/utils.ts