Cross-Site Scripting in react

ALTOGHSA-hg79-j56m-fxgv · Published 04/09/2020 · updated 01/10/2021

Package	Affected versions	Patched versions
react npm	`≥ 0.0.1, < 0.14.0`	`0.14.0`

Description

Versions of react prior to 0.14.0 are vulnerable to Cross-Site Scripting (XSS). The package's createElement function fails to properly validate its input object, allowing attackers to execute arbitrary JavaScript in a victim's browser.

Recommendation

Upgrade to version 0.14.0 or later.

References

facebook/react · PACKAGE
reactjs.org/blog/2015/10/07/react-v0.14.html · WEB
reactjs.org/blog/2019/10/22/react-release-channels.html · WEB
snyk.io/vuln/npm:react:20150318 · WEB
npmjs.com/advisories/1347 · WEB
danlec.com/blog/xss-via-a-spoofed-react-element · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free