[GHSA-3cgp-3xvw-98x8] React Router has XSS Vulnerability

[HF-CYGG]

Updates

• References

Comments
Add the upstream fix commit for this advisory.

The commit directly addresses the vulnerability described in
GHSA-3cgp-3xvw-98x8 by escaping JSON-LD content rendered by the
component before it is passed to dangerouslySetInnerHTML.

The commit changes the JSON-LD output from:

dangerouslySetInnerHTML={{ __html: json }}

to:

dangerouslySetInnerHTML={{ __html: escapeHtml(json) }}

and adds a regression test verifying that HTML-sensitive characters
in JSON-LD content are escaped.

The fix was merged in upstream PR #14316 and is included in
react-router 7.9.0, which is the patched version already recorded by
this advisory.

Upstream PR:
remix-run/react-router#14316

Fix commit:
remix-run/react-router@0e77485

React Router 7.9.0 release:
https://github.com/remix-run/react-router/releases/tag/react-router%407.9.0

No other advisory metadata is changed.

[github]

Hi there @brophdawg11! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory