[GHSA-wrjc-x8rr-h8h6] React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

[isnifer]

Updates

• Affected products
• References

Comments
react-router 6.30.6 still marked as non-fixed version, but it's a fix actually

[github]

Hi there @brophdawg11! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[brophdawg11]

6.30.6 was addressing GHSA-jjmj-jmhj-qwj2, and there is a PR to reflect that in #9156.

GHSA-wrjc-x8rr-h8h6 may be partially fixed by the same code, but it is not fully addressed and 6.30.6 is still vulnerable to some version of that.

This PR should be closed.

[isnifer]

@brophdawg11 thank you. Please, keep an eye on v6 branch as well

[brophdawg11]

V6 is EOL and will no longer be receiving norm security updates. Please update your app to v7 and let us know if you are running into issues.

[isnifer]

@brophdawg11 It's EOL, but security fixes still are publishing. I have no opportunity to migrate to v7 right now, so please don't forget to set correct fixed versions for v6 rather than ignore it.

[brophdawg11]

6.30.6 was a one-off fix for something we introduced in 6.30.2 in a separate CVE fix before EOL was announced. EOL specifically means v6 will not be receiving future CVE fixes, so you need to update your application to v7 if you wish to receive them moving forward.

[isnifer]

@brophdawg11 ok, gotcha. You won't mark 6.30.6 or any other future 6.x version as fixed for these issues, I won't migrate to v7. Deal.