Description
React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. There is no impact if the application is being used in Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been patched in @remix-run/react version 2.17.1 and react-router version 7.9.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| remix-run | react-router | @remix-run/react >= 1.15.0, < 2.17.1, react-router >= 7.0.0, < 7.9.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ansible Automation Platform Inside 2 | receptor +1 | 1.6.3-4.el9ap | RHSA-2026:3958 |
| Red Hat Ansible Automation Platform Developer 2 | automation-controller +1 | 4.7.9-1.el9ap | RHSA-2026:3958 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-django | 4.2.28-1.el9ap | RHSA-2026:3958 |
| Red Hat Ansible Automation Platform Developer 2 | receptor +1 | 1.6.3-4.el9ap | RHSA-2026:3958 |
| Red Hat Ansible Automation Platform 2 | automation-controller +4 | 4.7.9-1.el9ap | RHSA-2026:3958 |
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | 2.6.6-1.el9ap | RHSA-2026:3958 |
| Red Hat Ansible Automation Platform 2 | python3.12-aiohttp | 3.13.3-2.el9ap | RHSA-2026:3958 |
| Red Hat Ansible Automation Platform 2 | python3.12-django | 4.2.28-1.el9ap | RHSA-2026:3958 |
| Red Hat Ansible Automation Platform 2 | python3.12-protobuf | 5.29.6-1.el9ap | RHSA-2026:3958 |
| Red Hat Ansible Automation Platform 2 | receptor +1 | 1.6.3-4.el9ap | RHSA-2026:3958 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
boroeurnprach/CVE-2025-59057-PoC ★ 0 · Jan 13, 2026
A XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted conte…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @remix-run/react | >= 1.15.0, < 2.17.1 | 2.17.1 | GHSA-3cgp-3xvw-98x8 |
| npm | react-router | >= 7.0.0, < 7.9.0 | 7.9.0 | GHSA-3cgp-3xvw-98x8 |
Advisories 2
- RHSA-2026:3958 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2026-0752 IBM SPSS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 7, 2026