Cross-site Scripting (XSS)

🗓️ 14 Jan 2026 09:15:43Reported by Veracode Vulnerability DatabaseType

React Router XSS via untrusted input in meta() during SSR, enabling script:ld+json injection.

Reporter	Title	Published	Views	Family All 34
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Engineering AI hub.	6 May 202608:24	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by vulnerabilities in js-yaml, minimatch, and react-router	17 Mar 202607:49	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for January 2026	22 Apr 202617:04	–	ibm
IBM Security Bulletins	Security Bulletin: Carbon Charts React Router Security Vulnerabilities	27 Apr 202607:14	–	ibm
IBM Security Bulletins	Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale Management GUI and/or BDA are now included.	2 Mar 202623:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	2 Mar 202616:48	–	ibm
IBM Security Bulletins	Security Bulletin: XSS Vulnerability in React Router meta()/Meta APIs During SSR, affects watsonx.data	10 Apr 202605:59	–	ibm
Circl	CVE-2025-59057	10 Jan 202603:23	–	circl
CNNVD	react-router 跨站脚本漏洞	10 Jan 202600:00	–	cnnvd
CVE	CVE-2025-59057	10 Jan 202602:40	–	cve

Vulners

Node

shopify react-routerRange0.13.3–7.5.2js

shopify react-routerRange7.0.0-pre.0–7.9.0-pre.1js

shopify react-routerRange7.0.0–7.9.0-pre.1js

react @remix-run/reactRange1.15.0-pre.0–2.17.0js

react @remix-run/reactRange1.15.0–2.17.0js

Source	Link
github	www.github.com/remix-run/react-router/commit/0e774855797fcb3c7538c269158f4541beb55a1b
github	www.github.com/advisories/GHSA-3cgp-3xvw-98x8
github	www.github.com/remix-run/react-router/security/advisories/GHSA-3cgp-3xvw-98x8

23 May 2026 05:03Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.17.6

EPSS0.00023

SSVC