p PatchFirst

CVE-2025-62379

CVE-2025-62379 · Open Redirect in reflex-dev/reflex

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Reflex is a library to build full-stack web apps in pure Python. In versions 0.5.4 through 0.8.14, the /auth-codespace endpoint automatically assigns the redirect_to query parameter value directly to client-side links without any validation and triggers automatic clicks when the page loads in a GitHub Codespaces environment. This allows attackers to redirect users to arbitrary external URLs. The vulnerable route is only registered when a Codespaces environment is detected, and the detection is controlled by environment variables. The same behavior can be activated in production if the GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN environment variable is set. The vulnerability occurs because the code assigns the redirect_to query parameter directly to a.href without any validation and immediately triggers a click (automatic navigation), allowing users to be sent to arbitrary external domains. The execution condition is based on the presence of a sessionStorage flag, meaning it triggers immediately on first visits or in incognito/private browsing windows, with no server-side origin/scheme whitelist or internal path enforcement defenses in place. This issue has been patched in version 0.8.15. As a workaround, users can ensure that GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN is not set in a production environment.

CVSS 3.1 · Low · EPSS 0.3%

Published
Updated

Stack: python

Affected products and versions

  • reflex

    Versions
    • >= 0.5.4, < 0.8.15: Affected

    No fix published

  • reflex PyPI

    Versions
    • 0.5.10
    • 0.5.10.post1
    • 0.5.10a1
    • 0.5.10a2
    • 0.5.10a3
    • 0.5.4
    • 0.5.5
    • 0.5.5a1
    • 0.5.5a2
    • 0.5.6
    • 0.5.6a1
    • 0.5.6a2
    • 0.5.7
    • 0.5.7a1
    • 0.5.8
    • 0.5.8a1
    • 0.5.9
    • 0.5.9.dev1
    • 0.5.9a1
    • 0.6.0
    • 0.6.0a1
    • 0.6.0a2
    • 0.6.0a3
    • 0.6.0a4
    • 0.6.1
    • 0.6.1a1
    • 0.6.1a2
    • 0.6.2
    • 0.6.2.post1
    • 0.6.2a1
    • 0.6.2a2
    • 0.6.3
    • 0.6.3.post1
    • 0.6.3a1
    • 0.6.3a2
    • 0.6.3a3
    • 0.6.3a4
    • 0.6.4
    • 0.6.4a1
    • 0.6.4a2
    • 0.6.4a3
    • 0.6.5
    • 0.6.5a1
    • 0.6.5a2
    • 0.6.5a3
    • 0.6.6
    • 0.6.6.post1
    • 0.6.6.post2
    • 0.6.6.post3
    • 0.6.6a1
    • 0.6.6a2
    • 0.6.6a3
    • 0.6.7
    • 0.6.7a1
    • 0.6.7a2
    • 0.6.8
    • 0.6.8.post1
    • 0.6.8a1
    • 0.6.8a2
    • 0.7.0
    • 0.7.0.post1
    • 0.7.0a1
    • 0.7.0a2
    • 0.7.0a3
    • 0.7.0a4
    • 0.7.0a5
    • 0.7.1
    • 0.7.1.post1
    • 0.7.10
    • 0.7.10.post1
    • 0.7.10a1
    • 0.7.11
    • 0.7.11a1
    • 0.7.12
    • 0.7.12a1
    • 0.7.13
    • 0.7.13a1
    • 0.7.13a2
    • 0.7.14
    • 0.7.14a1
    • 0.7.14a2
    • 0.7.14a3
    • 0.7.14a4
    • 0.7.14a5
    • 0.7.14a6
    • 0.7.1a1
    • 0.7.1a2
    • 0.7.1a3
    • 0.7.1a4
    • 0.7.1a5
    • 0.7.2
    • 0.7.2.dev1
    • 0.7.2.post1
    • 0.7.2a1
    • 0.7.2a2
    • 0.7.3
    • 0.7.3.post1
    • 0.7.3a1
    • 0.7.3a2
    • 0.7.4
    • 0.7.4.post1
    • 0.7.4a0
    • 0.7.4a1
    • 0.7.4a2
    • 0.7.4a3
    • 0.7.5
    • 0.7.5.post1
    • 0.7.5a1
    • 0.7.6
    • 0.7.6.post1
    • 0.7.6a0
    • 0.7.6a1
    • 0.7.7
    • 0.7.7.post1
    • 0.7.7a1
    • 0.7.7a2
    • 0.7.8
    • 0.7.8.post1
    • 0.7.8a1
    • 0.7.9
    • 0.7.9.post1
    • 0.7.9a1
    • 0.7.9a2
    • 0.8.0
    • 0.8.0.post1
    • 0.8.0a1
    • 0.8.0a2
    • 0.8.0a3
    • 0.8.0a4
    • 0.8.0a5
    • 0.8.0a6
    • 0.8.0a7
    • 0.8.1
    • 0.8.1.post1
    • 0.8.10
    • 0.8.10a1
    • 0.8.11
    • 0.8.11a1
    • 0.8.12
    • 0.8.12a1
    • 0.8.12a2
    • 0.8.13
    • 0.8.13a1
    • 0.8.14
    • 0.8.14a1
    • 0.8.14a2
    • 0.8.1a1
    • 0.8.1a2
    • 0.8.2
    • 0.8.2a1
    • 0.8.3
    • 0.8.3a1
    • 0.8.3a2
    • 0.8.3a3
    • 0.8.4
    • 0.8.4a1
    • 0.8.4a2
    • 0.8.5
    • 0.8.5a1
    • 0.8.5a2
    • 0.8.6
    • 0.8.6a0
    • 0.8.6a1
    • 0.8.7
    • 0.8.7a1
    • 0.8.8
    • 0.8.8a1
    • 0.8.8a2
    • 0.8.9
    • 0.8.9a1
    • 0.8.9a2
    Affected ranges
    • ECOSYSTEM: ≥ 0.5.4, ≤ 0.8.14

    No fix published

Original sources

Check your server →