What is GHSA-hg79-j56m-fxgv?

GHSA-hg79-j56m-fxgv is a security advisory published by GitHub Security Advisories with High severity. Cross-Site Scripting in react

Why does GHSA-hg79-j56m-fxgv have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-hg79-j56m-fxgv?

GHSA-hg79-j56m-fxgv affects 1 product, including: npm/react:\u003e= 0.0.1, \u003c 0.14.0.

GHSA-hg79-j56m-fxgvHighDisclosed before NVD

Cross-Site Scripting in react

Vendor

GitHub Security Advisories

Published

September 4, 2020

Last Modified

January 9, 2023

📋 Description

Versions of react prior to 0.14.0 are vulnerable to Cross-Site Scripting (XSS). The package's createElement function fails to properly validate its input object, allowing attackers to execute arbitrary JavaScript in a victim's browser.

Recommendation

Upgrade to version 0.14.0 or later.

🎯 Affected products1

npm/react:>= 0.0.1, < 0.14.0

🔗 References (7)

https://snyk.io/vuln/npm:react:20150318
https://www.npmjs.com/advisories/1347
http://danlec.com/blog/xss-via-a-spoofed-react-element
https://github.com/facebook/react
https://reactjs.org/blog/2015/10/07/react-v0.14.html#notable-enhancements
https://reactjs.org/blog/2019/10/22/react-release-channels.html#experimental-channel
https://github.com/advisories/GHSA-hg79-j56m-fxgv