facebook/react · Security
Cross-Site Scripting in react
- GHSA ID
- GHSA-hg79-j56m-fxgv
- Severity
- high
- Published
- Updated
Description
Versions of react prior to 0.14.0 are vulnerable to Cross-Site Scripting (XSS). The package's createElement function fails to properly validate its input object, allowing attackers to execute arbitrary JavaScript in a victim's browser.
Recommendation
Upgrade to version 0.14.0 or later.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- https://snyk.io/vuln/npm:react:20150318 ↗
- https://www.npmjs.com/advisories/1347 ↗
- http://danlec.com/blog/xss-via-a-spoofed-react-element ↗
- https://github.com/facebook/react ↗
- https://reactjs.org/blog/2015/10/07/react-v0.14.html#notable-enhancements ↗
- https://reactjs.org/blog/2019/10/22/react-release-channels.html#experimental-channel ↗
- https://github.com/advisories/GHSA-hg79-j56m-fxgv ↗