High severity · published Jan 10, 2026
CVE-2025-59057
React Router has XSS Vulnerability
7.6
CVSS
0.5%
EPSS
No
On KEV
Description
React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. There is no impact if the application is being used in Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been patched in @remix-run/react version 2.17.1 and react-router version 7.9.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
react-router · remix-run
@remix-run/react >= 1.15.0, < 2.17.1; react-router >= 7.0.0, < 7.9.0 · source: vendor, NVD
RE
Remix-run/react · Shopify
1.15.0 through 2.17.0 · source: NVD
RH
Red Hat Ansible Automation Platform 2.6 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Ansible Automation Platform 2.6 for RHEL 9 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat OpenShift AI 2.25 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat OpenShift AI 3.3 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59057
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59057
Third Party Advisory
https://github.com/remix-run/react-router/security/advisories/GHSA-3cgp-3xvw-98x8
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:19712
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:3782
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:3958
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:3960
access.redhat.com
https://access.redhat.com/security/cve/CVE-2025-59057
More from react-router
9.1
CVE-2025-61686
React Router has Path Traversal in File Session Storage
8.2
CVE-2026-21884
React Router SSR XSS in ScrollRestoration
8.1
CVE-2026-42211
React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
7.5
CVE-2026-55685
React Router: Unauthenticated Denial of Service via Inefficient Route Matching
7.5
CVE-2026-42342
React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint