AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

CWE-79

https://access.redhat.com/errata/RHSA-2026:19712

https://access.redhat.com/errata/RHSA-2026:3782

https://access.redhat.com/errata/RHSA-2026:3958

https://access.redhat.com/errata/RHSA-2026:3960

https://access.redhat.com/security/cve/CVE-2025-59057

https://bugzilla.redhat.com/show_bug.cgi?id=2428426

https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-59057.json

[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 2.25","defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift_ai:2.25::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.3","defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift_ai:3.3::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 10","defaultStatus":"unaffected","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10"]},{"vendor":"Red Hat","product":"Red Hat Build of Kueue","defaultStatus":"unaffected","cpes":["cpe:/a:redhat:kueue_operator:1"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:9"]}]

{"timestamp":"2026-01-12T18:12:33.289843Z","id":"CVE-2025-59057","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"remix-run","product":"react-router","versions":[{"version":"@remix-run/react >= 1.15.0, < 2.17.1","status":"affected"},{"version":"react-router  >= 7.0.0, < 7.9.0","status":"affected"}]}]

OR
          *cpe:2.3:a:shopify:react-router:*:*:*:*:*:node.js:*:* versions from (including) 7.0.0 up to (including) 7.8.2
          *cpe:2.3:a:shopify:remix-run/react:*:*:*:*:*:node.js:*:* versions from (including) 1.15.0 up to (including) 2.17.0

GitHub, Inc.: https://github.com/remix-run/react-router/security/advisories/GHSA-3cgp-3xvw-98x8 Types: Third Party Advisory

React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag. There is no impact if the application is being used in Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been patched in @remix-run/react version 2.17.1 and react-router version 7.9.0.

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

CWE-79

https://github.com/remix-run/react-router/security/advisories/GHSA-3cgp-3xvw-98x8