reflex

🕸️ Web apps in pure Python 🐍

View on Pypi

View on Github

Activity

Latest release: 2d ago
Total releases: 391
Cadence: ~daily
Last 12 months: 89

Reach

Stars: 28.9k

Details

License: Apache-2.0
First release: Jun 19, 2023

Releases

Version	Released
`0.9.11` patch	Sep 11, 2026
`0.9.11a2` pre	Sep 11, 2026
`0.9.11a1` pre	Sep 10, 2026
`0.9.10.post2` pre	Sep 08, 2026
`0.9.10.post1` pre	Sep 02, 2026
`0.9.9.post1` pre	Sep 02, 2026
`0.9.10` patch	Sep 01, 2026
`0.9.9` patch	Aug 28, 2026
`0.9.9a2` pre	Aug 28, 2026
`0.9.9a1` pre	Aug 28, 2026
`0.9.8.post1` pre	Aug 18, 2026
`0.9.8` patch	Aug 04, 2026
`0.9.8a3` pre	Aug 04, 2026
`0.9.8a2` pre	Aug 04, 2026
`0.9.8a1` pre	Aug 03, 2026
`0.9.7` patch	Jul 15, 2026
`0.9.7a1` pre	Jul 15, 2026
`0.9.6.post2` pre	Jul 15, 2026
`0.9.6.post1` pre	Jun 26, 2026
`0.9.6` patch	Jun 25, 2026
`0.9.6a1` pre	Jun 25, 2026
`0.9.5.post2` pre	Jun 10, 2026
`0.9.5.post1` pre	Jun 10, 2026
`0.9.5` patch	Jun 10, 2026
`0.9.4` patch	Jun 04, 2026
`0.9.4a1` pre	Jun 02, 2026
`0.9.0.post1` pre	May 28, 2026
`0.9.2.post2` pre	May 28, 2026
`0.9.3` patch	May 23, 2026
`0.9.3a2` pre	May 22, 2026
`0.9.3a1` pre	May 21, 2026
`0.9.2.post1` pre	May 11, 2026
`0.9.2` patch	May 06, 2026
`0.9.2a2` pre	May 05, 2026
`0.9.2a1` pre	May 04, 2026
`0.9.1` patch	Apr 27, 2026
`0.9.1a2` pre	Apr 24, 2026
`0.9.1a1` pre	Apr 23, 2026
`0.9.0` minor	Apr 20, 2026
`0.9.0a5` pre	Apr 20, 2026
`0.9.0a4` pre	Apr 20, 2026
`0.9.0a3` pre	Apr 20, 2026
`0.9.0a2` pre	Apr 10, 2026
`0.9.0a1` pre	Apr 04, 2026
`0.8.28.post1` pre	Mar 19, 2026
`0.8.28` patch	Mar 16, 2026
`0.8.28a1` pre	Mar 13, 2026
`0.8.27` patch	Feb 17, 2026
`0.8.27a1` pre	Feb 14, 2026
`0.8.27a0` pre	Jan 21, 2026

1–50 of 391

Repository

reflex-dev/reflex

Forks: 1.8k
Open issues: 253
Language: Python

python
framework
open-source
gui
dashboard
fullstack

Dependencies (31)

Depends on

0.9.11

Used by

158

Supply-chain exposure

158 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (1)

CVE-2025-62379 PYSEC-2026-1868 GHSA-rfh5-c9h5-q8jm Jul 07, 2026

reflex-dev/reflex has an Open Redirect vulnerability

3.1 / 10
Low
Network High None Required Unchanged None Low None

Mitigation

Make sure GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN is not set in a production environment. So the following is correct:

assert os.getenv("GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN") is None

Vulnerability Description

Vulnerability Overview

When the GET /auth-codespace page loads in a GitHub Codespaces environment, it automatically assigns the redirect_to query parameter value directly to client-side links without any validation and triggers automatic clicks. This allows attackers to redirect users to arbitrary external URLs.

The route is only registered when a Codespaces environment is detected, and the detection is controlled by environment variables. This means that the same behavior can be activated in production if the corresponding environment variable is set.

Vulnerable Code Analysis

https://github.com/reflex-dev/reflex/blob/51f9f2c2f52cac4d66c07683a12bc0237311b6be/reflex/utils/codespaces.py#L18-L46

This code assigns the redirect_to query parameter directly to a.href without any validation and immediately triggers a click (automatic navigation), allowing users to be sent to arbitrary external domains, resulting in an open redirect vulnerability.

The execution condition is simply based on the presence of a sessionStorage flag, meaning it triggers immediately on first visits or in incognito/private browsing windows, with no server-side origin/scheme whitelist or internal path enforcement defenses in place.

PoC

PoC Description

Used the production configuration from docker-example (docker-example/production-compose).

Added a Codespaces detection environment variable to the app container in compose.yaml to forcibly expose the route.

GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN: dummy

The reverse proxy (Caddy) needs to be configured to forward /auth-codespace to the backend (required depending on the environment).

curl Example

https://localhost/auth-codespace?redirect_to=http://google.com

PoC MP4 https://file.notion.so/f/f/d105d145-04bc-45c5-b46c-ed880895e9de/a86c3e3b-f67f-45d1-8fa2-4aa0ba7d0068/poc.mp4?table=block&id=26955717-5d2e-805a-b53c-e25ee03f1d4b&spaceId=d105d145-04bc-45c5-b46c-ed880895e9de&expirationTimestamp=1760508000000&signature=ZPp8PVldfGOh0gB5tVElRV6GN789R-EG0oxZgkFjjLU&downloadName=poc.mp4

Impact

Phishing/Social Engineering Attacks

Users can be exploited by immediately redirecting from a trusted domain to external malicious sites, taking advantage of user trust. This enables login page spoofing, credential harvesting, and redirection to malware distribution pages.

Authentication/Session Flow Disruption

When users with valid sessions/cookies from the same origin click the link, they are redirected to unintended external domains, which can bypass or disrupt authentication/authorization flows. When combined with redirect-based flows like OAuth/OIDC, this can escalate into security incidents.

Affected versions

0.5.100.5.10.post10.5.10a10.5.10a20.5.10a30.5.40.5.50.5.5a10.5.5a20.5.60.5.6a10.5.6a2

+ 159 more Show less

0.5.70.5.7a10.5.80.5.8a10.5.90.5.9.dev10.5.9a10.6.00.6.0a10.6.0a20.6.0a30.6.0a40.6.10.6.1a10.6.1a20.6.20.6.2.post10.6.2a10.6.2a20.6.30.6.3.post10.6.3a10.6.3a20.6.3a30.6.3a40.6.40.6.4a10.6.4a20.6.4a30.6.50.6.5a10.6.5a20.6.5a30.6.60.6.6.post10.6.6.post20.6.6.post30.6.6a10.6.6a20.6.6a30.6.70.6.7a10.6.7a20.6.80.6.8.post10.6.8a10.6.8a20.7.00.7.0.post10.7.0a10.7.0a20.7.0a30.7.0a40.7.0a50.7.10.7.1.post10.7.100.7.10.post10.7.10a10.7.110.7.11a10.7.120.7.12a10.7.130.7.13a10.7.13a20.7.140.7.14a10.7.14a20.7.14a30.7.14a40.7.14a50.7.14a60.7.1a10.7.1a20.7.1a30.7.1a40.7.1a50.7.20.7.2.dev10.7.2.post10.7.2a10.7.2a20.7.30.7.3.post10.7.3a10.7.3a20.7.40.7.4.post10.7.4a00.7.4a10.7.4a20.7.4a30.7.50.7.5.post10.7.5a10.7.60.7.6.post10.7.6a00.7.6a10.7.70.7.7.post10.7.7a10.7.7a20.7.80.7.8.post10.7.8a10.7.90.7.9.post10.7.9a10.7.9a20.8.00.8.0.post10.8.0a10.8.0a20.8.0a30.8.0a40.8.0a50.8.0a60.8.0a70.8.10.8.1.post10.8.100.8.10a10.8.110.8.11a10.8.120.8.12a10.8.12a20.8.130.8.13a10.8.140.8.14a10.8.14a20.8.1a10.8.1a20.8.20.8.2a10.8.30.8.3a10.8.3a20.8.3a30.8.40.8.4a10.8.4a20.8.50.8.5a10.8.5a20.8.60.8.6a00.8.6a10.8.70.8.7a10.8.80.8.8a10.8.8a20.8.90.8.9a10.8.9a2

References

https://github.com/reflex-dev/reflex/security/advisories/GHSA-rfh5-c9h5-q8jm
https://nvd.nist.gov/vuln/detail/CVE-2025-62379
https://github.com/reflex-dev/reflex/commit/ade12549f3c0ddab3d7382c581bc04a3c1f989ec
https://file.notion.so/f/f/d105d145-04bc-45c5-b46c-ed880895e9de/a86c3e3b-f67f-45d1-8fa2-4aa0ba7d0068/poc.mp4?table=block&id=26955717-5d2e-805a-b53c-e25ee03f1d4b&spaceId=d105d145-04bc-45c5-b46c-ed880895e9de&expirationTimestamp=1760508000000&signature=ZPp8PVldfGOh0gB5tVElRV6GN789R-EG0oxZgkFjjLU&downloadName=poc.mp4
https://github.com/reflex-dev/reflex
https://github.com/reflex-dev/reflex/blob/51f9f2c2f52cac4d66c07683a12bc0237311b6be/reflex/utils/codespaces.py#L18-L46

Updated Jul 07, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

minor 8
patch 99
pre 283

391 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More