GitHub Advisoryadvisory · npm

GHSA-hg79-j56m-fxgv Cross-Site Scripting in react

HIGH Published 2020-09-04 Modified 2021-10-01 Official page ↗
Ecosystem
npm
Packages
react
Severity
High
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm react: >= 0.0.1, < 0.14.0 → fixed in 0.14.0

Description

Versions of `react` prior to 0.14.0 are vulnerable to Cross-Site Scripting (XSS). The package's `createElement` function fails to properly validate its input object, allowing attackers to execute arbitrary JavaScript in a victim's browser. Recommendation Upgrade to version 0.14.0 or later.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References