Description
A XSS vulnerability exists in in React Router’s meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag.
Recommendation
Update the @remix-run/react package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.15.0, <= 2.17.0
- Patched version(s): 2.17.1
References
Could your website be exposed too?
SmartScanner can check your website for React Router has XSS Vulnerability and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Vuetify has a Cross-site Scripting (XSS) vulnerability in the VDatePicker component - CVE-2025-8082
- React Router has Path Traversal in File Session Storage - CVE-2025-61686
- React Router SSR XSS in ScrollRestoration - CVE-2026-21884
- Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering - CVE-2025-54075
You might also like:
See something that needs correcting? Let us knowUpdated January 11, 2026