Executive brief
React Router is a popular routing library for JavaScript applications. In its Framework Mode, a flaw in how the meta() API generates structured data tags allows attackers to inject malicious JavaScript code that executes on the server during page rendering. If an application uses untrusted user input (like a database field or URL parameter) to populate these metadata tags, an attacker could hijack user sessions, steal sensitive data, or perform actions on behalf of users viewing the affected page.
Technical details
This is a server-side XSS vulnerability (CWE-79) affecting React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags. The vulnerability occurs because untrusted input is not properly sanitized before being inserted into script tags during server-side rendering (SSR). An attacker can exploit this by crafting malicious JSON-LD payload in any user-controlled input that flows into the meta() function. The attack requires a logged-in user (PR:L) and user interaction (UI:R) to exploit, but has a broad scope (S:C) with high confidentiality impact. The vulnerability does not affect applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). Patches are available: react-router 7.9.0 and @remix-run/react 2.17.1.
Affected products
- Remix react-router 7.0.0 to 7.8.2
- Remix @remix-run/react 1.15.0 to 2.17.0
Timeline
- 2026-01-08: disclosed: Vulnerability disclosed to GitHub Advisory Database
- 2026-01-08: patched: react-router 7.9.0 and @remix-run/react 2.17.1 released with patches