GitHub Advisoryadvisory · npm

GHSA-2589-w6xf-983r Cross-site scripting in react-bootstrap-table

MEDIUM Published 2021-12-10 Modified 2021-07-01 Official page ↗
Aliases
CVE-2021-23398
Ecosystem
npm
Packages
react-bootstrap-table
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-06-25

Affected packages

• npm react-bootstrap-table: <= 4.3.1 (no fix yet)

Description

All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is returned, leading to dangerouslySetInnerHTML being used, which does not sanitize the output.

Related

Alias · CVE (1)

  • CVE-2021-23398 All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References