Cross-site scripting in Remix - CVE-2025-59057
Published: June 19, 2026
Vulnerability identifier: #VU134931
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2025-59057
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary JavaScript in the victim's browser.
The vulnerability exists due to cross-site scripting in the Meta component's meta() API for script:ld+json tag generation when rendering untrusted content during server-side rendering in Framework Mode. A remote attacker can supply crafted content to execute arbitrary JavaScript in the victim's browser.
This issue affects Framework Mode and does not affect Declarative Mode or Data Mode.
Affected software
Remix
React Router
Ansible Automation Platform
python3.12-pillow-debugsource (Red Hat package)
React Router
Ansible Automation Platform
python3.12-pillow-debugsource (Red Hat package)
How to mitigate CVE-2025-59057
Install security update from vendor's website.
Remix - update to 2.17.1
React Router - update to 7.9.0
Ansible Automation Platform - update to 2.6
python3.12-pillow-debugsource (Red Hat package) - update to 10.3.0-2.el9ap
React Router - update to 7.9.0
Ansible Automation Platform - update to 2.6
python3.12-pillow-debugsource (Red Hat package) - update to 10.3.0-2.el9ap