Log in Start free

Vulnerability · Published Jan 10, 2026 · Assigned by GitHub_M

CVE-2025-59057React Router has XSS Vulnerability

High 7.6

In plain English

A high-severity cross-site scripting in react-router from remix-run. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.6High
Exploit odds (30 days)0.5%top 56.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. There is no impact if the application is being used in Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been patched in @remix-run/react version 2.17.1 and react-router version 7.9.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@remix-run/react2.17.1GHSA-3cgp-3xvw-98x8
npmreact-router7.9.0GHSA-3cgp-3xvw-98x8

Affected products (as reported)

VendorProductVersions
remix-run react-router @remix-run/react >= 1.15.0, < 2.17.1react-router >= 7.0.0, < 7.9.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

References