The vulnerability identified as CVE-2025-30859 involves an open redirect issue in the AliNext ali2woo-lite software component of the guru-aliexpress project. Versions up to and including 3.5.1 are affected. The flaw allows attackers to redirect users to untrusted external URLs, which can be leveraged for phishing attacks. The CVSS 3.1 base score is 4.7, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and partial confidentiality impact. No patches or official fixes have been published yet, and no known exploits are reported.

The primary impact is the potential for phishing attacks due to the open redirect vulnerability. Attackers can exploit this to redirect users to malicious sites, possibly deceiving them into divulging sensitive information. There is no reported impact on integrity or availability, and no known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should exercise caution with URLs from affected versions and consider implementing temporary mitigations such as validating and sanitizing redirect URLs within their deployment if possible.