CVE-2025-59057: Shopify React Router XSS in Meta component script generation

CVE-2025-59057 · Severity: high · CVSS 7.6 · Published 2026-01-10

React Router is a popular routing library for JavaScript applications. In its Framework Mode, a flaw in how the meta() API generates structured data tags allows attackers to inject malicious JavaScript code that executes on the server during page rendering. If an application uses untrusted user input (like a database field or URL parameter) to populate these metadata tags, an attacker could hijack user sessions, steal sensitive data, or perform actions on behalf of users viewing the affected page.

Technologies: Shopify Remix-Run\. Vendors: npm, Remix, Shopify.

Quick answers

Is CVE-2025-59057 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-59057 being exploited in the wild.
How severe is CVE-2025-59057?
High severity, with a CVSS score of 7.6, published 10 January 2026.
Which products and versions are affected?
@remix-run/react (npm) >= 1.15.0, <= 2.17.0, SEMVER:introduced=1.15.0,fixed=2.17.1; Remix React >= 7.0.0, <= 7.8.2.
Is there a fix for CVE-2025-59057?
Yes. @remix-run/react (npm): upgrade to 2.17.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-59057 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-59057?
Check whether you run @remix-run/react (npm), Remix React or Shopify Remix-Run\ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @remix-run/react (npm): upgrade to 2.17.1 or later
    npm install @remix-run/react@2.17.1

Technical details

This is a server-side XSS vulnerability (CWE-79) affecting React Router's meta()/&lt;Meta&gt; APIs in Framework Mode when generating script:ld+json tags. The vulnerability occurs because untrusted input is not properly sanitized before being inserted into script tags during server-side rendering (SSR). An attacker can exploit this by crafting malicious JSON-LD payload in any user-controlled input that flows into the meta() function. The attack requires a logged-in user (PR:L) and user interaction (UI:R) to exploit, but has a broad scope (S:C) with high confidentiality impact. The vulnerability does not affect applications using Declarative Mode (&lt;BrowserRouter&gt;) or Data Mode (createBrowserRouter/&lt;RouterProvider&gt;). Patches are available: react-router 7.9.0 and @remix-run/react 2.17.1.

Affected products

  • Remix react-router 7.0.0 to 7.8.2
  • Remix @remix-run/react 1.15.0 to 2.17.0

Identifiers

  • CVE-2025-59057
  • GHSA-3cgp-3xvw-98x8

Timeline

  • 2026-01-08: disclosed: Vulnerability disclosed to GitHub Advisory Database
  • 2026-01-08: patched: react-router 7.9.0 and @remix-run/react 2.17.1 released with patches

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.