high
—
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
Versions of `react` prior to 0.14.0 are vulnerable to Cross-Site Scripting (XSS). The package's `createElement` function fails to properly validate its input object, allowing attackers to execute arbitrary JavaScript in a victim's browser.
## Recommendation
Upgrade to version 0.14.0 or later.
Patch / fix
- npm react 0.14.0
Is GHSA-hg79-j56m-fxgv in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | react | >=0.0.1, <0.14.0 |
0.14.0 |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
- Technology feeds
References
-
github.com
/facebook/react
package
-
reactjs.org
/blog/2015/10/07/react-v0.14.html#notable-enhancements
web
-
reactjs.org
/blog/2019/10/22/react-release-channels.html#experimental-channel
web
-
snyk.io
/vuln/npm:react:20150318
web
-
npmjs.com
/advisories/1347
web
-
danlec.com
/blog/xss-via-a-spoofed-react-element
web
Sources
- GitHub Advisory GHSA-hg79-j56m-fxgv
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.