CVE-2025-59057: React Router has XSS Vulnerability
A XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag.
> [!NOTE] > This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
Other sources
React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. There is no impact if the application is being used in Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been patched in @remix-run/react version 2.17.1 and react-router version 7.9.0.
— MITRE
React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/Meta APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. There is no impact if the application is being used in Declarative Mode (BrowserRouter) or Data Mode (createBrowserRouter/RouterProvider). This issue has been patched in @remix-run/react version 2.17.1 and react-router version 7.9.0.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@remix-run/reactto a version that resolves this vulnerability.Fixed in 2.17.1 - Upgrade
Upgrade
npm/react-routerto a version that resolves this vulnerability.Fixed in 7.9.0 - Upgrade
Upgrade
@remix-run/reactto a version that resolves this vulnerability.Fixed in 2.17.1 - Upgrade
Upgrade
react-routerto a version that resolves this vulnerability.Fixed in 7.9.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59057?
CVE-2025-59057 has been classified as a high-severity vulnerability due to its potential for arbitrary JavaScript execution.
How do I fix CVE-2025-59057?
To remediate CVE-2025-59057, update the affected package to @remix-run/react version 2.17.1 or react-router version 7.9.0.
What software is affected by CVE-2025-59057?
CVE-2025-59057 affects @remix-run/react versions from 1.15.0 to 2.17.0 and react-router versions from 7.0.0 to 7.8.2.
What is the exploit method for CVE-2025-59057?
CVE-2025-59057 can be exploited via an XSS attack during Server-Side Rendering (SSR) by using untrusted content in script:ld+json tags.
When was CVE-2025-59057 disclosed?
CVE-2025-59057 was disclosed in October 2023.