Vulnetix
Try Vulnetix Request Demo
CVE-2025-59057 PUBLISHED CVSS 7.599999904632568 HIGH

React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. There is no impact if the application is being used in Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been patched in @remix-run/react version 2.17.1 and react-router version 7.9.0.

EPSS 0.02% · 4.8th percentile

Risk Scores

CVSS v3.1
7.599999904632568
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
EPSS Score
0.02%
4.8th percentile

Affected Products

VendorProductVersions
remix-runreact-routerreact-router >= 7.0.0, < 7.9.0, *, @remix-run/react >= 1.15.0, < 2.17.1
shopifyreact-router7.0.0, 7.0.0
remix-runreact1.15.0, 1.15.0
shopifyremix-run\/react1.15.0, 1.15.0
npmreact-router7.0.0, 7.0.0

Timeline

References

Open in Interactive Console →