HIGH7.6
GHSA-3cgp-3xvw-98x8
React Router has XSS Vulnerability
Quick fix
GHSA-3cgp-3xvw-98x8 — react-router: upgrade to the fixed version with the command below.
npm install react-router@7.9.0Details
A XSS vulnerability exists in in React Router's `meta()`/`<Meta>` APIs in [Framework Mode](https://reactrouter.com/start/modes#framework) when generating `script:ld+json` tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag.
> [!NOTE] > This does not impact applications using [Declarative Mode](https://reactrouter.com/start/modes#declarative) (`<BrowserRouter>`) or [Data Mode](https://reactrouter.com/start/modes#data) (`createBrowserRouter`/`<RouterProvider>`).
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/remix-run/react-router/security/advisories/GHSA-3cgp-3xvw-98x8[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2025-59057[ADVISORY]
- https://github.com/remix-run/react-router/pull/14316[WEB]
- https://github.com/remix-run/react-router/commit/0e774855797fcb3c7538c269158f4541beb55a1b[WEB]
- https://access.redhat.com/errata/RHSA-2026:19712[WEB]
- https://access.redhat.com/errata/RHSA-2026:3782[WEB]
- https://access.redhat.com/errata/RHSA-2026:3958[WEB]
- https://access.redhat.com/errata/RHSA-2026:3960[WEB]
- https://access.redhat.com/security/cve/CVE-2025-59057[WEB]
- https://bugzilla.redhat.com/show_bug.cgi?id=2428426[WEB]
- https://github.com/remix-run/react-router[PACKAGE]
- https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v790[WEB]
- https://github.com/remix-run/react-router/releases/tag/react-router@7.9.0[WEB]
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-59057.json[WEB]