The chi Go HTTP router versions prior to 5.2.2 have an open redirect vulnerability in the RedirectSlashes middleware function. The middleware constructs redirect URLs based on the Host header without proper validation, enabling an attacker to supply a malicious Host header value. This can cause users to be redirected to arbitrary external hosts, potentially leading to phishing or credential theft. The advisory is a duplicate of GHSA-vrw8-fxc6-2r93 and has been withdrawn. The vulnerability is tracked as CWE-601 (Open Redirect).

An attacker can exploit this vulnerability by manipulating the Host header in HTTP requests to cause the RedirectSlashes middleware to redirect users to arbitrary external URLs. This can be used in phishing attacks to trick users into visiting malicious sites or to steal credentials. There is no indication of privilege escalation or direct code execution. No known exploits are reported in the wild.

Upgrade chi to version 5.2.2 or later, where this open redirect vulnerability in RedirectSlashes middleware is fixed. Since no patch links are provided in this advisory, refer to the original advisory GHSA-vrw8-fxc6-2r93 for official remediation details. No other mitigations are indicated.