GitHub Advisoryadvisory · npm

GHSA-g53w-52xc-2j85 Cross-Site Scripting in react

MEDIUM Published 2020-09-04 Modified 2021-10-04 Official page ↗
Aliases
CVE-2013-7035
Ecosystem
npm
Packages
react
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm react: >= 0.4.0, < 0.4.2 → fixed in 0.4.2 • npm react: >= 0.5.0, < 0.5.2 → fixed in 0.5.2

Description

Affected versions of `react` are vulnerable to Cross-Site Scripting (XSS). The package fails to properly sanitize input used to create keys. This may allow attackers to execute arbitrary JavaScript if a key is generated from user input. Recommendation If you are using `react` 0.5.x, upgrade to version 0.5.2 or later. If you are using `react` 0.4.x, upgrade to version 0.4.2 or later.

Related

Alias · not in database (1)

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References