CVE-2025-59057

React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. There is no impact if the application is being used in Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been patched in @remix-run/react version 2.17.1 and react-router version 7.9.0.

• CWE-79
• CWE-79

• https://github.com/remix-run/react-router/security/advisories/GHSA-3cgp-3xvw-98x8Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:19712
• https://access.redhat.com/errata/RHSA-2026:3782
• https://access.redhat.com/errata/RHSA-2026:3958
• https://access.redhat.com/errata/RHSA-2026:3960
• https://access.redhat.com/security/cve/CVE-2025-59057
• https://bugzilla.redhat.com/show_bug.cgi?id=2428426
• https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-59057.json

Published

Jan 10, 2026

Last Modified

Jul 15, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59051The FreePBX Endpoint Manager module includes a Network Scann…8.6
• CVE-2025-59052Angular is a development platform for building mobile and de…7.1
• CVE-2025-59053AIRI is a self-hosted, artificial intelligence based Grok Co…9.6
• CVE-2025-59054dstack is a software development kit (SDK) to simplify the d…8.5
• CVE-2025-59055InstantCMS is a free and open source content management syst…7.2
• CVE-2025-59056FreePBX is an open-source web-based graphical user interface…7.5
• CVE-2025-59058httpsig-rs is a Rust implementation of IETF RFC 9421 http me…5.9
• CVE-2025-59059Remote Code Execution Vulnerability in NashornScriptEngineCr…9.8
• CVE-2025-5906A vulnerability classified as critical has been found in cod…9.8
• CVE-2025-59060Hostname verification bypass issue in Apache Ranger NiFiRegi…5.3
• CVE-2025-5907A vulnerability classified as critical was found in TOTOLINK…8.8
• CVE-2025-5908A vulnerability, which was classified as critical, has been …8.8