Input validation error in React Router - CVE-2026-40181

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU134925

Input validation error in React Router - CVE-2026-40181

Published: June 19, 2026


Vulnerability identifier: #VU134925
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-40181
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to redirect users to an external domain.

The vulnerability exists due to improper input validation in the redirect function when processing URLs with a path starting with // that is reinterpreted as a protocol-relative URL. A remote attacker can supply a crafted URL to redirect users to an external domain.

This does not affect applications using declarative mode.


Affected software

React Router
IBM Cloud Transformation Advisor
IBM SPSS Collaboration and Deployment Services
Application Modernization Accelerator

How to mitigate CVE-2026-40181

Install security update from vendor's website.

React Router - addressed in versions 6.30.4, 7.14.1
IBM Cloud Transformation Advisor - update to 5.0.0
Application Modernization Accelerator - update to 5.0.0
IBM SPSS Collaboration and Deployment Services - update to 9.0.0.0.0 IF13

External References

Related Security Bulletins