CVE-2025-59057 - CVE House

Back to Database

Status published High CVE-2025-59057

React Router has XSS Vulnerability

7.6 CVSS

Vulnerability Description

React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. There is no impact if the application is being used in Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been patched in @remix-run/react version 2.17.1 and react-router version 7.9.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59057

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://github.com/remix-run/react-router/security/advisories/GHSA-3cgp-3xvw-98x8

More from remix-run

View All →

React Router has unexpected external redirect via untrusted paths

React Router has Path Traversal in File Session Storage

React Router allows pre-render data spoofing on React-Router framework mode

React Router allows a DoS via cache poisoning by forcing SPA mode

Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers

Affected Vendor

remix-run

View all reports →

Affected Software

react-router

Vulnerable Versions:

@remix-run/react >= 1.15.0, < 2.17.1, react-router >= 7.0.0, < 7.9.0

Timeline

Official Publish: January 10th, 2026

Last Modified: July 15th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement