CVE-2025-59057
React Router has XSS Vulnerability
React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. There is no impact if the application is being used in Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been patched in @remix-run/react version 2.17.1 and react-router version 7.9.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
React Router has XSS Vulnerability
React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. There is no impact if the application is being used in Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been patched in @remix-run/react version 2.17.1 and react-router version 7.9.0.
- Record
CVE-2025-59057- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79, CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-1469
React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. There is no impact if the application is being used in Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been patched in @remix-run/react version 2.17.1 and react-router version 7.9.0.
- Record
EUVD-2026-1469- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3cgp-3xvw-98x8
React Router has XSS Vulnerability
A XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag.
[!NOTE] This does not impact applications using Declarative Mode (
<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
- Record
GHSA-3cgp-3xvw-98x8- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. There is no impact if the application is being used in Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been patched in @remix-run/react version 2.17.1 and react-router version 7.9.0.
- Record
CVE-2025-59057- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
React Router has XSS Vulnerability
React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. There is no impact if the application is being used in Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been patched in @remix-run/react version 2.17.1 and react-router version 7.9.0.
- Record
CVE-2025-59057- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-3cgp-3xvw-98x8
React Router has XSS Vulnerability
A XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag.
[!NOTE] This does not impact applications using Declarative Mode (
<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).
- Record
GHSA-3cgp-3xvw-98x8- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Show 6 moreShow less
OSVRHSA-2026:3958
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Record
RHSA-2026:3958- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1775521864 No score
TuxCare security update for @remix-run/testing (1 CVE)
TuxCare rebuilt @remix-run/testing to address 1 CVE. Fixed in 1.19.3-tuxcare.1.
- Record
CLSA-2026-1775521864- Updated
- 2026-11-02
OSVCLSA-2026-1792161539 No score
TuxCare security update for @remix-run/server-runtime (4 CVEs)
TuxCare rebuilt @remix-run/server-runtime to address 4 CVEs. Fixed in 2.17.0-tuxcare.1.
- Record
CLSA-2026-1792161539- Updated
- 2026-11-02
OSVCLSA-2026-1792161540 No score
TuxCare security update for @remix-run/server-runtime (1 CVE)
TuxCare rebuilt @remix-run/server-runtime to address 1 CVE. Fixed in 1.19.3-tuxcare.1.
- Record
CLSA-2026-1792161540- Updated
- 2026-11-02
OSVCLSA-2026-1792279963 No score
TuxCare security update for @remix-run/react (3 CVEs)
TuxCare rebuilt @remix-run/react to address 3 CVEs. Fixed in 2.17.0-tuxcare.1.
- Record
CLSA-2026-1792279963- Updated
- 2026-11-02
OSVCLSA-2026-1792279964 No score
TuxCare security update for @remix-run/react (1 CVE)
TuxCare rebuilt @remix-run/react to address 1 CVE. Fixed in 1.19.3-tuxcare.1.
- Record
CLSA-2026-1792279964- Updated
- 2026-11-02
Affected products
- @tanstack react-router
- remix-run react-router
- shopify react-router
- shopify remix-run\/react
- red hat ansible automation platform 2.6
- red hat ansible automation platform 2.6 for rhel 9
- red hat build of kueue
- red hat enterprise linux 10
- red hat enterprise linux 9
- red hat openshift ai 2.25
- red hat openshift ai 3.3
Affected packages
| Package | Affected | Fixed |
|---|---|---|
react-routernpm |
7.0.0 to 7.8.2 | 7.9.0 |
@remix-run/reactnpm |
1.15.0 to 2.17.0 | 2.17.1 |
@remix-run/testingTuxCare:npm |
1.19.3-tuxcare.0 up to 1.19.3-tuxcare.1, plus listed versions 1.19.3 |
1.19.3-tuxcare.1 |
@remix-run/server-runtimeTuxCare:npm From an advisory covering 4 CVEs |
2.17.0-tuxcare.0 up to 2.17.0-tuxcare.1, plus listed versions 2.17.0 |
2.17.0-tuxcare.1 |
@remix-run/server-runtimeTuxCare:npm |
1.19.3-tuxcare.0 up to 1.19.3-tuxcare.1, plus listed versions 1.19.3 |
1.19.3-tuxcare.1 |
@remix-run/reactTuxCare:npm From an advisory covering 3 CVEs |
2.17.0-tuxcare.0 up to 2.17.0-tuxcare.1, plus listed versions 2.17.0 |
2.17.0-tuxcare.1 |
@remix-run/reactTuxCare:npm |
1.19.3-tuxcare.0 up to 1.19.3-tuxcare.1, plus listed versions 1.19.3 |
1.19.3-tuxcare.1 |
react-routernpm |
7.0.0 up to 7.9.0 | 7.9.0 |
@remix-run/reactnpm |
1.15.0 up to 2.17.1 | 2.17.1 |
automation-platform-uiRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:2.6.6-1.el9ap | 0:2.6.6-1.el9ap |
Show 27 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python3.12-djangoRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 14 CVEs |
before 0:4.2.28-1.el9ap | 0:4.2.28-1.el9ap |
python3.12-djangoRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:4.2.28-1.el9ap | 0:4.2.28-1.el9ap |
receptorRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 14 CVEs |
before 0:1.6.3-4.el10ap | 0:1.6.3-4.el10ap |
receptor-debuginfoRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 14 CVEs |
before 0:1.6.3-4.el10ap | 0:1.6.3-4.el10ap |
receptor-debugsourceRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 14 CVEs |
before 0:1.6.3-4.el10ap | 0:1.6.3-4.el10ap |
receptorctlRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 14 CVEs |
before 0:1.6.3-4.el10ap | 0:1.6.3-4.el10ap |
receptorRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 14 CVEs |
before 0:1.6.3-4.el9ap | 0:1.6.3-4.el9ap |
receptorctlRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 14 CVEs |
before 0:1.6.3-4.el9ap | 0:1.6.3-4.el9ap |
receptorRed Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 14 CVEs |
before 0:1.6.3-4.el9ap | 0:1.6.3-4.el9ap |
receptorctlRed Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 14 CVEs |
before 0:1.6.3-4.el9ap | 0:1.6.3-4.el9ap |
receptorRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:1.6.3-4.el9ap | 0:1.6.3-4.el9ap |
receptor-debuginfoRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:1.6.3-4.el9ap | 0:1.6.3-4.el9ap |
receptor-debugsourceRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:1.6.3-4.el9ap | 0:1.6.3-4.el9ap |
receptorctlRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:1.6.3-4.el9ap | 0:1.6.3-4.el9ap |
python3.12-aiohttpRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:3.13.3-2.el9ap | 0:3.13.3-2.el9ap |
python3.12-aiohttp-debuginfoRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:3.13.3-2.el9ap | 0:3.13.3-2.el9ap |
python3.12-aiohttp-debugsourceRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:3.13.3-2.el9ap | 0:3.13.3-2.el9ap |
python3.12-protobufRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:5.29.6-1.el9ap | 0:5.29.6-1.el9ap |
python3.12-protobuf-debuginfoRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:5.29.6-1.el9ap | 0:5.29.6-1.el9ap |
python3.12-protobuf-debugsourceRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:5.29.6-1.el9ap | 0:5.29.6-1.el9ap |
automation-controllerRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 14 CVEs |
before 0:4.7.9-1.el9ap | 0:4.7.9-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 14 CVEs |
before 0:4.7.9-1.el9ap | 0:4.7.9-1.el9ap |
automation-controllerRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:4.7.9-1.el9ap | 0:4.7.9-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:4.7.9-1.el9ap | 0:4.7.9-1.el9ap |
automation-controller-serverRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:4.7.9-1.el9ap | 0:4.7.9-1.el9ap |
automation-controller-uiRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:4.7.9-1.el9ap | 0:4.7.9-1.el9ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 14 CVEs |
before 0:4.7.9-1.el9ap | 0:4.7.9-1.el9ap |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | boroeurnprach/CVE-2025-59057-PoC | 2026-01-13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-59057 is a high vulnerability (CVSS 7.6) in @tanstack React-router, published January 8, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. Fixed in react-router 7.9.0.
References
github.com/remix-run/react-router/security/advisories/GHSA-3cgp-3xvw-98x8
access.redhat.com/security/cve/CVE-2025-59057
bugzilla.redhat.com/show_bug.cgi?id=2428426
security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-59057.json
Show 87 moreShow less
nvd.nist.gov/vuln/detail/CVE-2025-59057
docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/html/release_notes/patch_releases
issues.redhat.com/browse/AAP-62864
cve.org/CVERecord?id=CVE-2025-13465
docs.djangoproject.com/en/dev/releases/security
groups.google.com/g/django-announce
djangoproject.com/weblog/2026/feb/03/security-releases
go.dev/cl/736712
pkg.go.dev/vuln/GO-2026-4341