Vulnerabilities in pkg:npm/react-router

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3cgp-3xvw-98x8",
  "modified" : "2026-09-08T16:31:34Z",
  "published" : "2026-01-08T20:42:20Z",
  "aliases" : [ "CVE-2025-59057" ],
  "summary" : "React Router has XSS Vulnerability",
  "details" : "A XSS vulnerability exists in in React Router's `meta()`/`<Meta>` APIs in [Framework Mode](https://reactrouter.com/start/modes#framework) when generating `script:ld+json` tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag.\n\n> [!NOTE]\n> This does not impact applications using [Declarative Mode](https://reactrouter.com/start/modes#declarative) (`<BrowserRouter>`) or [Data Mode](https://reactrouter.com/start/modes#data) (`createBrowserRouter`/`<RouterProvider>`).",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "react-router"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "7.0.0"
      }, {
        "fixed" : "7.9.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 7.8.2"
    }
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@remix-run/react"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.15.0"
      }, {
        "fixed" : "2.17.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.17.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/remix-run/react-router/security/advisories/GHSA-3cgp-3xvw-98x8"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-59057"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/remix-run/react-router/pull/14316"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/remix-run/react-router/commit/0e774855797fcb3c7538c269158f4541beb55a1b"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:19712"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:3782"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:3958"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:3960"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/security/cve/CVE-2025-59057"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2428426"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/remix-run/react-router"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v790"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/remix-run/react-router/releases/tag/react-router@7.9.0"
  }, {
    "type" : "WEB",
    "url" : "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-59057.json"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-01-08T20:42:20Z",
    "nvd_published_at" : "2026-01-10T03:15:48Z"
  }
}