GHSA-g53w-52xc-2j85MediumCVSS 6.5

Cross-Site Scripting in react

Published
September 4, 2020
Last Modified
May 22, 2023

🔗 CVE IDs covered (1)

CVE-2013-7035 →

📋 Description

Affected versions of react are vulnerable to Cross-Site Scripting (XSS). The package fails to properly sanitize input used to create keys. This may allow attackers to execute arbitrary JavaScript if a key is generated from user input.

Recommendation

If you are using react 0.5.x, upgrade to version 0.5.2 or later. If you are using react 0.4.x, upgrade to version 0.4.2 or later.

🎯 Affected products2

  • npm/react:>= 0.4.0, < 0.4.2
  • npm/react:>= 0.5.0, < 0.5.2

🔗 References (6)