React Router has XSS Vulnerability

CAO 7.6CVE-2025-59057 · GHSA-3cgp-3xvw-98x8 · Công bố 10/01/2026 · cập nhật 15/07/2026

Tóm tắt nhanh

CVE-2025-59057 là lỗ hổng mức CAO (CVSS 7.6) ảnh hưởng react-router (shopify), remix-run/react (shopify), @remix-run/react.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.50%, cao hơn 43.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.17.1, 7.9.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
react-router shopify	`≥ 7.0.0, ≤ 7.8.2`	Chưa có bản vá
remix-run/react shopify	`≥ 1.15.0, ≤ 2.17.0`	Chưa có bản vá
@remix-run/react npm	`≥ 1.15.0, < 2.17.1`	`2.17.1`
react-router npm	`≥ 7.0.0, < 7.9.0`	`7.9.0`

Mô tả

A XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag.

[!NOTE] This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).

Mô tả của NVD

React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. There is no impact if the application is being used in Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been patched in @remix-run/react version 2.17.1 and react-router version 7.9.0.