There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain
    URLs passed to the redirect function can trigger an open redirect to an external domain due to path values
    starting with // being reinterpreted as protocol-relative URLs. The level of impact depends on the
    validation done by the application prior to returning the redirect. This does not impact applications
    using Declarative Mode (<BrowserRouter>). This is patched in versions 7.14.1 and 6.30.4. (CVE-2026-40181)

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - React Router 是 React 的路由器。在整个7.14.0版本和6.7.0整个6.30.3版本7.0.0中，由于以 // 开头的路径值被重新解释为协议相关的 URL，因此传递给重定向函数的某些 URL 可触发对外部域的开放重定向。影响级别取决于应用程序在返回重定向之前所做的验证。此问题不影响使用声明式模式 （）<BrowserRouter> 的应用程序。版本和 6.30.4中已对7.14.1此进行了修补。（CVE-2026-40181）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - React Router 是 React 的路由器。在整個7.14.06.7.06.30.3版本7.0.0中，傳遞給重新導向函式的某些 URL 可能會觸發開放重新導向到外部網域，因為以 // 開頭的路徑值被重新解譯為通訊協定相對 URL。影響程度取決於應用程式在傳回重新導向之前所完成的驗證。這不會影響使用宣告式模式 （）<BrowserRouter> 的應用程式。這已在版本 7.14.1 和 6.30.4中修補。（CVE-2026-40181）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - React Router は React 用のルーターです。7.0.0 から 7.14.0 および 6.7.0 から 6.30.3 までのバージョンでは、// で始まるパス値がプロトコル相対 URL として再解釈されるため、リダイレクト関数に渡される特定の URL が外部ドメインへのオープンリダイレクトを発生させる可能性があります。影響のレベルは、リダイレクトを返す前にアプリケーションが行う検証によって異なります。これは、宣言モード(<BrowserRouter>)を使用しているアプリケーションには影響しません。これは、バージョン 7.14.1 および 6.30.4 でパッチされます。(CVE-2026-40181)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21448-1 advisory.

    - CVE-2025-7783: form-data: unsafe `Math.random()` function is used to select a boundary value for     multipart       form-encoded data (bsc#1246822).
    - CVE-2026-12143: form-data: CRLF injection via unescaped multipart field names and filenames     (bsc#1272310).
    - CVE-2026-13149: brace-expansion: `expand()` function exhibits exponential-time complexity when     processing       non-expanding `{}` brace groups (bsc#1269927).
    - CVE-2026-13311: shell-quote: quadratic complexity in `parse()` function when processing specially     crafted strings       (bsc#1269359).
    - CVE-2026-13676: fast-uri: host-based policy bypass due to failure to canonicalize Unicode/IDN hostnames     for       HTTP-family URLs (bsc#1269595).
    - CVE-2026-27601: underscore: DoS via stack overflow due to missing depth limits in `_.flatten` and     `_.isEqual`       functions (bsc#1259169).
    - CVE-2026-40181: react-router: open redirect to an external domain due to path values starting with `//`     being       reinterpreted as protocol-relative URLs (bsc#1272311).
    - CVE-2026-49356: @babel/core: arbitrary file read via `sourceMappingURL` comment (bsc#1272317).
    - CVE-2026-53550: js-yaml: quadratic complexity in merge-key processing when processing a crafted YAML     document       (bsc#1268851).
    - CVE-2026-53632: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows (bsc#1272319).
    - CVE-2026-54466: websocket-driver: message corruption via abuse of protocol length headers (bsc#1272312).
    - CVE-2026-54490: websocket-driver: resource limit bypass via message compression (bsc#1272313).
    - CVE-2026-55602: http-proxy-middleware: Host-header-driven backend routing bypass via `router` host+path     substring       matching (bsc#1272318).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain     URLs passed to the redirect function can trigger an open redirect to an external domain due to path values     starting with // being reinterpreted as protocol-relative URLs. The level of impact depends on the     validation done by the application prior to returning the redirect. This does not impact applications     using Declarative Mode (<BrowserRouter>). This is patched in versions 7.14.1 and 6.30.4. (CVE-2026-40181)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
442612	SCA: security update for @remix-run/router, react-router (GHSA-2j2x-hqr9-3h42)	Tenable Cloud Security	SCA Checks	2026/6/4	2026/8/5	high
442612	SCA: security update for @remix-run/router, react-router (GHSA-2j2x-hqr9-3h42)	Tenable Self-Hosted Container Security	SCA Checks	2026/6/4	2026/8/5	high
321658	Linux Distros 未修补的漏洞：CVE-2026-40181	Nessus	Misc.	2026/6/20	2026/8/25	high
321658	Linux Distros 未修補弱點：CVE-2026-40181	Nessus	Misc.	2026/6/20	2026/8/25	high
321658	Linux Distros のパッチ未適用の脆弱性: CVE-2026-40181	Nessus	Misc.	2026/6/20	2026/8/25	high
330583	openSUSE 16 Security Update : agama-web-ui (openSUSE-SU-2026:21448-1)	Nessus	SuSE Local Security Checks	2026/7/29	2026/7/29	critical
321658	Linux Distros Unpatched Vulnerability : CVE-2026-40181	Nessus	Misc.	2026/6/20	2026/8/25	high

检测

插件搜索

high

high

high

high

high

critical

high