GHSA-3cgp-3xvw-98x8 (CVE-2025-59057)

Details

A XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag.

[!NOTE] This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).

Affected Packages

@remix-run/react

npm

Fixed in:

2.17.1

react-router

npm

Fixed in:

7.9.0

References

ADVISORY

https://github.com/advisories/GHSA-3cgp-3xvw-98x8

PACKAGE

https://github.com/remix-run/react-router

WEB

https://github.com/remix-run/react-router/security/advisories/GHSA-3cgp-3xvw-98x8

ADVISORY

https://nvd.nist.gov/vuln/detail/CVE-2025-59057