| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| react | ≥ 16.0.0, < 16.0.1≥ 16.1.0, < 16.1.2≥ 16.2.0, < 16.2.1≥ 16.3.0, < 16.3.3≥ 16.4.0, < 16.4.2 | 16.0.116.1.216.2.116.3.316.4.2 |
| react-dom | ≥ 16.0.0, < 16.0.1≥ 16.1.0, < 16.1.2≥ 16.2.0, < 16.2.1≥ 16.3.0, < 16.3.3≥ 16.4.0, < 16.4.2 | 16.0.116.1.216.2.116.3.316.4.2 |
Affected versions of react-dom are vulnerable to Cross-Site Scripting (XSS). The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by this vulnerability, the application needs to:
ReactDOMServerIf you are using react-dom 16.0.x, upgrade to 16.0.1 or later.
If you are using react-dom 16.1.x, upgrade to 16.1.2 or later.
If you are using react-dom 16.2.x, upgrade to 16.2.1 or later.
If you are using react-dom 16.3.x, upgrade to 16.3.3 or later.
If you are using react-dom 16.4.x, upgrade to 16.4.2 or later.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí