p PatchFirst

CVE-2025-59057

CVE-2025-59057 · React Router has XSS Vulnerability

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. There is no impact if the application is being used in Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been patched in @remix-run/react version 2.17.1 and react-router version 7.9.0.

CVSS 7.6 · Alta · EPSS 0,5% · Corrección disponible

Publicación
Actualización

Pila tecnológica: node

Productos y versiones afectados

  • react-router

    Versiones
    • @remix-run/react >= 1.15.0, < 2.17.1: Afectada
    • react-router >= 7.0.0, < 7.9.0: Afectada

    Sin corrección publicada

  • react-router npm

    Intervalos de versiones afectados
    • SEMVER: ≥ 7.0.0, < 7.9.0

    Actualiza a 7.9.0

  • @remix-run/react npm

    Intervalos de versiones afectados
    • SEMVER: ≥ 1.15.0, < 2.17.1

    Actualiza a 2.17.1

Fuentes originales

Comprueba tu servidor →