PT-2025-44570 · Unknown · React Router+1

Published 2025-10-30 · Updated 2026-01-15 · CVE-2025-59057

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions react-router versions 7.0.0 through 7.8.2 @remix-run/react versions 1.15.0 through 2.17.0

Description A cross-site scripting (XSS) issue exists in React Router's meta()/ APIs in Framework Mode when generating script:ld+json tags. This could allow arbitrary JavaScript execution during server-side rendering (SSR) if untrusted content is used to generate the tag. The issue does not affect applications using Declarative Mode () or Data Mode (createBrowserRouter/).

Recommendations Update to react-router version 7.9.0. Update to @remix-run/react version 2.17.1.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-01281

CVE-2025-59057

GHSA-3CGP-3XVW-98X8

RHSA-2026:3958

Affected Products

@Remix-Run/React

React Router

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59057.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-59057 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3cgp-3xvw-98x8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59057 · Security Note
• https://bdu.fstec.ru/vul/2026-01281 · Security Note
• https://github.com/remix-run/react-router/security/advisories/GHSA-3cgp-3xvw-98x8 · Note
• https://github.com/remix-run/react-router · Note
• https://twitter.com/CVEnew/status/2009837433316077582 · Twitter Post
• https://twitter.com/The_Hunt_x/status/2009817635509415947 · Twitter Post
• https://twitter.com/grok/status/2010204195761119574 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2009923035487195428 · Twitter Post
• https://twitter.com/cracbot/status/2011755299234058531 · Twitter Post
• https://twitter.com/mercuryheavens/status/1984013425723457568 · Twitter Post