React Router versions 7.0.0 through 7.8.2 and @remix-run/react versions 1.15.0 through 2.17.0 contain a cross-site scripting vulnerability (CWE-79) in the meta() and <Meta> APIs when operating in Framework Mode. This vulnerability arises during server-side rendering when generating script:ld+json tags, which can lead to arbitrary JavaScript execution if untrusted input is used to generate these tags. The vulnerability does not affect applications running in Declarative Mode or Data Mode. The flaw has been addressed and patched in react-router version 7.9.0 and @remix-run/react version 2.17.1. The CVSS v3.1 base score is 7.6, indicating a high severity with network attack vector, low attack complexity, requiring privileges and user interaction, and impacting confidentiality and integrity with no availability impact. Vendor advisories from Red Hat confirm the vulnerability and patch availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the server-side rendered page when using the affected meta() or <Meta> APIs in Framework Mode with untrusted input. This can lead to confidentiality breaches and partial integrity loss of the rendered content. There is no impact if the application uses Declarative Mode or Data Mode. The vulnerability does not affect availability. No known exploits in the wild have been reported as of the publication date.

An official fix is available. Users should upgrade to @remix-run/react version 2.17.1 or later and react-router version 7.9.0 or later to remediate this vulnerability. Applications not using Framework Mode for meta() or <Meta> APIs are not impacted. Review usage of these APIs with untrusted input and apply the patch accordingly. Refer to the Red Hat advisories for detailed update instructions. No additional mitigations are required if the application is not using the vulnerable APIs in Framework Mode.