XSS Vulnerability in React Router and @remix-run/react: Potential for Arbitrary JavaScript Execution
Summary
GHSA-3cgp-3xvw-98x8: React Router has XSS Vulnerability. Affects react-router versions >= 7.0.0, < 7.9.0. Fixed in 7.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
React Router is a popular library for routing in React applications, enabling developers to create dynamic single-page applications with ease. It provides various modes of operation, including Framework Mode, which allows for server-side rendering (SSR). The library's flexibility and functionality make it a go-to choice for many developers. However, a recent vulnerability has been identified in its Framework Mode, specifically within the meta() and <Meta> APIs, which could expose applications to cross-site scripting (XSS) attacks if untrusted content is used.
Vulnerability Detail
The identified XSS vulnerability arises from the way React Router's meta() and <Meta> APIs generate script:ld+json tags during server-side rendering. If an application uses untrusted content to create these tags, it could lead to arbitrary JavaScript execution, allowing attackers to manipulate the application and potentially compromise user data. This vulnerability is particularly concerning for applications that rely on Framework Mode, as it opens the door for severe security breaches.
How To Fix
Latest published version: 8.5.0 as of 23 Oct 2026
npm install react-router@8.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.9.0
This is the first release that contains the fix.
npm install react-router@7.9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updates cannot be applied, consider switching to Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>), which are not affected by this vulnerability. This change can help mitigate the risk until the packages are updated.
Conclusion
The XSS vulnerability in React Router and @remix-run/react poses a significant risk to applications using Framework Mode. It is essential to update to the patched versions to safeguard against potential attacks. Additionally, utilizing workarounds can provide temporary relief until updates are applied.
See every vulnerability recorded for react-router →
FAQ
The CVSS score of this vulnerability is 7.6, indicating a high severity level.
Versions of React Router up to and including 7.8.2 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If exploited, this vulnerability could allow attackers to execute arbitrary JavaScript in the context of the application, potentially leading to data theft, session hijacking, or other malicious activities.
Yes, switching to Declarative Mode or Data Mode can help mitigate the risk until the packages are updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for react-router.
