Launch Week Day 1: Announcing Security Design Review
HIGH 7.6 npm

React Router has XSS Vulnerability

GHSA-3cgp-3xvw-98x8 · CVE-2025-59057

Published · Modified

Description

A XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag.

[!NOTE]
This does not impact applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).

Ready to move

Start Securing

Free, no credit card | First findings in minutes