React Router has XSS Vulnerability

高 7.6CVE-2025-59057 · GHSA-3cgp-3xvw-98x8 · 10/01/2026 公開 · 15/07/2026 更新

要点

CVE-2025-59057 は react-router (shopify), remix-run/react (shopify), @remix-run/react に影響する深刻度「高」 (CVSS 7.6) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.50%（全脆弱性の 43.1% より高い）。
対処：2.17.1, 7.9.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
react-router shopify	`≥ 7.0.0, ≤ 7.8.2`	修正版なし
remix-run/react shopify	`≥ 1.15.0, ≤ 2.17.0`	修正版なし
@remix-run/react npm	`≥ 1.15.0, < 2.17.1`	`2.17.1`
react-router npm	`≥ 7.0.0, < 7.9.0`	`7.9.0`

概要

A XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag.

[!NOTE] This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).

NVD の説明

React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. There is no impact if the application is being used in Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been patched in @remix-run/react version 2.17.1 and react-router version 7.9.0.