React Router has XSS Vulnerability

Description

A XSS vulnerability exists in in React Router’s meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag.

Recommendation

Update the @remix-run/react package to the latest compatible version. Followings are version details:

• Affected version(s): >= 1.15.0, <= 2.17.0
• Patched version(s): 2.17.1

References

• GHSA-3cgp-3xvw-98x8
• CVE-2025-59057
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering - CVE-2025-54075
• React Router has Path Traversal in File Session Storage (GHSA-9583-h5hc-x8cw) - CVE-2025-61686
• React Router has Path Traversal in File Session Storage - CVE-2025-61686
• React Router SSR XSS in ScrollRestoration - CVE-2026-21884

Tags:

npm

@remix-run/react