MediumGHSA-g53w-52xc-2j85CVE-2013-7035
Cross-Site Scripting in react
Published 4 Sept 2020 · Updated 8 Nov 2023
Affected packages
reactnpm
- Affected
- >=0.4.0 <0.4.2
- Fixed in
- 0.4.2
Update to the fixed version for your release line, for example:
npm install react@0.4.2reactnpm
- Affected
- >=0.5.0 <0.5.2
- Fixed in
- 0.5.2
Update to the fixed version for your release line, for example:
npm install react@0.5.2Details
Affected versions of react are vulnerable to Cross-Site Scripting (XSS). The package fails to properly sanitize input used to create keys. This may allow attackers to execute arbitrary JavaScript if a key is generated from user input.
Recommendation
If you are using react 0.5.x, upgrade to version 0.5.2 or later.
If you are using react 0.4.x, upgrade to version 0.4.2 or later.
Is GHSA-g53w-52xc-2j85 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected react, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2013-7035
- Linkgithub.com/facebook/react/commit/393a889aaceb761f058b09a701f889fa8f8b4e64
- Linkgithub.com/facebook/react/commit/94a9a3e752fe089ab23f3a90c26d20d46d62ab10
- Packagegithub.com/facebook/react
- Linkreactjs.org/blog/2013/12/18/react-v0.5.2-v0.4.2.html
- Linksnyk.io/vuln/npm:react:20131217
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.