CVEvulnerability
CVE-2021-23398
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2021-06-24
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 3.1 ([email protected])
- 6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is returned, leading to dangerouslySetInnerHTML being used, which does not sanitize the output.
Affected configurations
• react-bootstrap-table project react-bootstrap-table
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/AllenFang/react-bootstrap-table/blob/26d07defab759e4f9bce22d1d568690830b8d9d7/src/TableBody.js%23L114-L118 Broken Link
- https://github.com/AllenFang/react-bootstrap-table/issues/2071 Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314286 Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-REACTBOOTSTRAPTABLE-1314285 Exploit, Third Party Advisory
- https://github.com/AllenFang/react-bootstrap-table/blob/26d07defab759e4f9bce22d1d568690830b8d9d7/src/TableBody.js%23L114-L118 Broken Link
- https://github.com/AllenFang/react-bootstrap-table/issues/2071 Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314286 Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-REACTBOOTSTRAPTABLE-1314285 Exploit, Third Party Advisory