React Router has XSS Vulnerability

Description

A XSS vulnerability exists in in React Router’s meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag.

Recommendation

Update the @remix-run/react package to the latest compatible version. Followings are version details:

• Affected version(s): >= 1.15.0, <= 2.17.0
• Patched version(s): 2.17.1

References

• GHSA-3cgp-3xvw-98x8
• CVE-2025-59057
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• React Router SSR XSS in ScrollRestoration - CVE-2026-21884
• Cross-site scripting in Swagger-UI - CVE-2019-17495
• Path Traversal in simplehttpserver - CVE-2018-16478
• Cross-Site Scripting in html-pages - CVE-2018-16481

Tags:

npm

@remix-run/react