CVE-2025-59057

216.73.217.98

· Published 10/01/2026 03:15 · Modified 10/01/2026 03:15

Labels: CVE-2025-59057 2026-01-10 CVE-2025-59057 CWE-79 [email protected]

Essential information

Published: 10/01/2026 03:15
Modified: 10/01/2026 03:15
Author: —
Creator: —
CVSS: 7.6 HIGH (v3.1)
CISA KEV: No
CWE: —
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

CVSS metrics

Description

React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. There is no impact if the application is being used in Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been patched in @remix-run/react version 2.17.1 and react-router version 7.9.0.

NVD status

Status: Received — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
remix-run / react	`cpe:2.3:a:remix-run:react:1.15.0-2.17.0:::::::*`
react-router / react-router	`cpe:2.3:a:react-router:react-router:7.0.0-7.8.2:::::::*`