React Router allows developers to redirect users to arbitrary URLs by passing a path value to its redirect function, but when that path begins with double slashes (//) the function incorrectly treats it as a protocol‑relative URL, effectively enabling an attacker to redirect the user to an external domain. This flaw is a classic Open Redirect (CWE‑601) that can be abused for phishing or misleading users to malicious sites, thereby potentially compromising the integrity of the user experience.

Vendors: Remix Run – React Router. Affected component versions include React Router 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3. The issue is resolved in 7.14.1 and 6.30.4. Applications that operate in Declarative Mode (<BrowserRouter>) are not impacted.

The CVSS score of 6.6 indicates moderate severity, and the EPSS score is not available; the vulnerability is not listed in CISA KEV. The attack vector requires only that a malicious actor supplies or manipulates a redirect parameter containing a path that starts with //, and no special privileges or prior compromise are needed. If the host application does not perform strict validation or whitelisting of redirect destinations, the attacker can lure users into following the forged redirect, exposing them to fraud or more covert attacks.