Reflected cross-site scripting (XSS) In react
Description
Cross-Site Scripting in react
Versions of react prior to 0.14.0 are vulnerable to Cross-Site Scripting (XSS). The package's createElement function fails to properly validate its input object, allowing attackers to execute arbitrary JavaScript in a victim's browser.
Recommendation
Upgrade to version 0.14.0 or later.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 npm | 0.14.0 |
Aliases
1.
References
1. 2. 3. 4.