Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWhnNzktajU2bS1meGd2
Cross-Site Scripting in react
Versions of react prior to 0.14.0 are vulnerable to Cross-Site Scripting (XSS). The package's createElement function fails to properly validate its input object, allowing attackers to execute arbitrary JavaScript in a victim's browser.
Recommendation
Upgrade to version 0.14.0 or later.
Permalink: https://github.com/advisories/GHSA-hg79-j56m-fxgvJSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWhnNzktajU2bS1meGd2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 4 years ago
Updated: almost 2 years ago
Identifiers: GHSA-hg79-j56m-fxgv
References:
- https://snyk.io/vuln/npm:react:20150318
- https://www.npmjs.com/advisories/1347
- http://danlec.com/blog/xss-via-a-spoofed-react-element
- https://github.com/facebook/react
- https://reactjs.org/blog/2015/10/07/react-v0.14.html#notable-enhancements
- https://reactjs.org/blog/2019/10/22/react-release-channels.html#experimental-channel
- https://github.com/advisories/GHSA-hg79-j56m-fxgv
Blast Radius: 0.0
Affected Packages
npm:react
Dependent packages: 275,174Dependent repositories: 2,830,385
Downloads: 117,286,823 last month
Affected Version Ranges: >= 0.0.1, < 0.14.0
Fixed in: 0.14.0
All affected versions: 0.0.1, 0.0.2, 0.0.3, 0.1.2, 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.3.0, 0.3.4, 0.3.5, 0.5.0, 0.5.1, 0.5.2, 0.6.0, 0.6.1, 0.6.2, 0.6.3, 0.7.0, 0.7.1, 0.8.0, 0.9.0, 0.10.0, 0.11.0, 0.11.1, 0.11.2, 0.12.0, 0.12.1, 0.12.2, 0.13.0, 0.13.1, 0.13.2, 0.13.3
All unaffected versions: 0.14.0, 0.14.1, 0.14.2, 0.14.3, 0.14.4, 0.14.5, 0.14.6, 0.14.7, 0.14.8, 0.14.9, 0.14.10, 15.0.0, 15.0.1, 15.0.2, 15.1.0, 15.2.0, 15.2.1, 15.3.0, 15.3.1, 15.3.2, 15.4.0, 15.4.1, 15.4.2, 15.5.0, 15.5.1, 15.5.2, 15.5.3, 15.5.4, 15.6.0, 15.6.1, 15.6.2, 15.7.0, 16.0.0, 16.1.0, 16.1.1, 16.2.0, 16.3.0, 16.3.1, 16.3.2, 16.4.0, 16.4.1, 16.4.2, 16.5.0, 16.5.1, 16.5.2, 16.6.0, 16.6.1, 16.6.2, 16.6.3, 16.7.0, 16.8.0, 16.8.1, 16.8.2, 16.8.3, 16.8.4, 16.8.5, 16.8.6, 16.9.0, 16.10.0, 16.10.1, 16.10.2, 16.11.0, 16.12.0, 16.13.0, 16.13.1, 16.14.0, 17.0.0, 17.0.1, 17.0.2, 18.0.0, 18.1.0, 18.2.0, 18.3.0, 18.3.1