CVE-2025-59057

Published Jan 10, 2026

Last updated 4 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-59057 describes a Cross-Site Scripting (XSS) vulnerability found within React Router's `meta()` and `<Meta>` APIs when operating in Framework Mode. This flaw specifically arises during the generation of `script:ld+json` tags. If untrusted user-supplied content is incorporated into this tag generation process, it can lead to the injection and execution of arbitrary JavaScript code during Server-Side Rendering (SSR). The vulnerability affects `@remix-run/react` versions 1.15.0 through 2.17.0 and `react-router` versions 7.0.0 through 7.8.2. Applications utilizing Declarative Mode (`<BrowserRouter>`) or Data Mode (`createBrowserRouter`/`<RouterProvider>`) are not impacted by this issue.

Description: React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. There is no impact if the application is being used in Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been patched in @remix-run/react version 2.17.1 and react-router version 7.9.0.
Source: security-advisories@github.com
NVD status: Analyzed
Products: react-router, remix-run\/react

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.6
Impact score: 4.7
Exploitability score: 2.3
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-79

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:*",
            "matchCriteriaId": "F4E34485-ECF4-43E3-888E-CED503030BD0",
            "versionEndIncluding": "7.8.2",
            "versionStartIncluding": "7.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:shopify:remix-run\\/react:*:*:*:*:*:node.js:*:*",
            "matchCriteriaId": "54EBA7E4-4D3E-4BDD-92DD-BCC1ED3FDF4C",
            "versionEndIncluding": "2.17.0",
            "versionStartIncluding": "1.15.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.