CVE-2025-62379 is a low-severity (CVSS 3.1) Open Redirect vulnerability in reflex. No vendor fix is recorded yet; mitigation options are listed below.
Open Redirect in reflex-dev/reflex
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for CVE-2025-62379.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
CVE-2025-62379 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 377,636 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
reflexReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Mitigation
Make sure GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN is not set in a production environment. So the following is correct:
assert os.getenv("GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN") is None
Vulnerability Description
Vulnerability Overview
- When the GET /auth-codespace page loads in a GitHub Codespaces environment, it automatically assigns the redirect_to query parameter value directly to client-side links without any validation and triggers automatic clicks. This allows attackers to redirect users to arbitrary external URLs.
- The route is only registered when a Codespaces environment is detected, and the detection is controlled by environment variables. This means that the same behavior can be activated in production if the corresponding environment variable is set.
Vulnerable Code Analysis
- This code assigns the redirect_to query parameter directly to a.href without any validation and immediately triggers a click (automatic navigation), allowing users to be sent to arbitrary external domains, resulting in an open redirect vulnerability.
- The execution condition is simply based on the presence of a sessionStorage flag, meaning it triggers immediately on first visits or in incognito/private browsing windows, with no server-side origin/scheme whitelist or internal path enforcement defenses in place.
PoC
PoC Description
<img width="623" height="497" alt="image" src="https://github.com/user-attachments/assets/55ef4828-09fa-451b-a7cc-8fcaad6a2a21" />- Used the production configuration from docker-example (docker-example/production-compose).
- Added a Codespaces detection environment variable to the app container in compose.yaml to forcibly expose the route.
- GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN: dummy
- The reverse proxy (Caddy) needs to be configured to forward /auth-codespace to the backend (required depending on the environment).
curl Example
https://localhost/auth-codespace?redirect_to=http://google.com
Impact
Phishing/Social Engineering Attacks
Users can be exploited by immediately redirecting from a trusted domain to external malicious sites, taking advantage of user trust. This enables login page spoofing, credential harvesting, and redirection to malware distribution pages.
Authentication/Session Flow Disruption
When users with valid sessions/cookies from the same origin click the link, they are redirected to unintended external domains, which can bypass or disrupt authentication/authorization flows. When combined with redirect-based flows like OAuth/OIDC, this can escalate into security incidents.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | reflex | ≥ 0.5.4 | No fix |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for reflex, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Remediation status
No patched version of reflex has shipped for CVE-2025-62379 yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.
Mitigate without a patch
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2025-62379 can be triaged on real exposure rather than presence alone.
Tailored to CVE-2025-62379. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2025-62379 in your dependencies?
O3 Security finds CVE-2025-62379 across PyPI dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.