React Router versions 6.0.0 through 7.17.0 allow an open redirect by using backslashes in <Link> elements and the useNavigate function. The vulnerability corresponds to CWE‑601, which permits attackers to redirect users to arbitrary URLs. This can be used to trick users into visiting malicious sites and may facilitate phishing or drive‑by compromise. The issue is a follow‑up to a previous CVE involving similar bypasses.

The affected product is the react‑router library, produced by remix‑run. All versions from 6.0.0 up to and including 7.17.0 are vulnerable. The vulnerability is triggered when developers embed backslashes in URLs within <Link> components or pass them to useNavigate, causing the router to interpret them as path separators and redirect accordingly.

The CVSS score of 5.1 indicates medium severity. The EPSS score of < 1% suggests a low probability of exploitation at present. The vulnerability is not listed in CISA KEV catalog. The likely attack vector is a crafted link that a user might click within a React application; the attacker can control the destination URL and potentially redirect users to malicious domains. An attacker could use this to subvert user trust and perform phishing or drive‑by downloads. The vulnerability provides no direct access to code execution or data exfiltration, but the redirect itself can be used as a stepping stone in further attacks.