CVE-2025-62379

Reflex (Python web app framework) versions 0.5.4–0.8.14 contain an Open Redirect in the /auth-codespace route: the redirect_to query parameter is assigned directly to client-side links without validation, triggering automatic navigation, which can redirect users to arbitrary external URLs. The vu...

CVE-2025-62379 Open Redirect in reflex-dev/reflex

Reflex is a library to build full-stack web apps in pure Python. In versions 0.5.4 through 0.8.14, the /auth-codespace endpoint automatically assigns the redirectto query parameter value directly to client-side links without any validation and triggers automatic clicks when the page loads in a...

PT-2025-42375

Name of the Vulnerable Software and Affected Versions Reflex versions 0.5.4 through 0.8.14 Description Reflex is a library used to build full-stack web applications in Python. Versions 0.5.4 through 0.8.14 contain an issue in the /auth-codespace endpoint where the redirect to query parameter valu...

CVE-2025-62379: URL Redirection to Untrusted Site

Reflex is a library to build full-stack web apps in pure Python. In versions 0.5.4 through 0.8.14, the /auth-codespace endpoint automatically assigns the redirectto query parameter value directly to client-side links without any validation and triggers automatic clicks when the page loads in a...

Reflex input validation error vulnerability

Reflex is a web application from the Reflex open source. An input validation error vulnerability exists in Reflex versions 0.5.4 through 0.8.14, which stems from an unvalidated redirectto query parameter value that could cause a user to be redirected to an arbitrary external URL...

CVE-2025-62379

creationtimestamp| type| source ---|---|--- 2025-10-14 23:48:41+00:00| published-proof-of-concept| https://github.com/reflex-dev/reflex/security/advisories/GHSA-rfh5-c9h5-q8jm...

GHSA-G8C6-8FJJ-2R4M vulnerabilities

Vulnerabilities for packages: open-webui, reflex...

CVE-2025-61765 vulnerabilities

Vulnerabilities for packages: open-webui, reflex...

GHSA-G8C6-8FJJ-2R4M vulnerabilities

Vulnerabilities for packages: open-webui, reflex...

CVE-2025-61765 vulnerabilities

Vulnerabilities for packages: open-webui, reflex...

EUVD-2013-7240

Malware in sbrugna...

EUVD-2024-0913

Malicious code in bioql PyPI...

CVE-2021-35953

fastrack Reflex 2.0 W307SREFLEXv90.89 Activity Tracker allows a Remote attacker to cause a Denial of Service device outage via crafted choices of the last three bytes of a characteristic value...

CVE-2013-7482

The reflex-gallery plugin before 1.4.3 for WordPress has XSS...

CVE-2025-47425 vulnerabilities

Vulnerabilities for packages: reflex...

GHSA-RF8X-9MHR-49WG vulnerabilities

Vulnerabilities for packages: reflex...

CVE-2025-47425 vulnerabilities

Vulnerabilities for packages: reflex...

GHSA-RF8X-9MHR-49WG vulnerabilities

Vulnerabilities for packages: reflex...

Access Control Bypass

Overview reflex is a Web apps in pure Python. Affected versions of this package are vulnerable to Access Control Bypass through the event handling mechanism. An attacker can impersonate other users or gain unauthorized administrative access by manipulating state fields that are not intended to be...

llm-strategy (>=2.1.0, <=2.2.0), llmtracer (>=1.1.0, <=1.2.1) potentially affected by CVE-2025-47425 via reflex (0.3.10)

reflex PYPI version 0.3.10 is affected by a known vulnerability. The following packages have a transitive dependency on reflex and may be impacted: - llm-strategy =2.1.0, =1.1.0, =1.2.1 Source cves: CVE-2025-47425 Source advisory: GHSA-RF8X-9MHR-49WG...