Cross-Site Scripting in react-dom
Published 4 Jan 2019 · Updated 8 Nov 2023
Affected packages
- Affected
- >=16.0.0 <16.0.1
- Fixed in
- 16.0.1
npm install react-dom@16.0.1- Affected
- >=16.1.0 <16.1.2
- Fixed in
- 16.1.2
npm install react-dom@16.1.2- Affected
- >=16.2.0 <16.2.1
- Fixed in
- 16.2.1
npm install react-dom@16.2.1- Affected
- >=16.3.0 <16.3.3
- Fixed in
- 16.3.3
npm install react-dom@16.3.3- Affected
- >=16.4.0 <16.4.2
- Fixed in
- 16.4.2
npm install react-dom@16.4.2Details
Affected versions of react-dom are vulnerable to Cross-Site Scripting (XSS). The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by this vulnerability, the application needs to:
- be a server-side React app
- be rendered to HTML using
ReactDOMServer - include an attribute name from user input in an HTML tag
Recommendation
If you are using react-dom 16.0.x, upgrade to 16.0.1 or later.
If you are using react-dom 16.1.x, upgrade to 16.1.2 or later.
If you are using react-dom 16.2.x, upgrade to 16.2.1 or later.
If you are using react-dom 16.3.x, upgrade to 16.3.3 or later.
If you are using react-dom 16.4.x, upgrade to 16.4.2 or later.
Is GHSA-mvjj-gqq2-p4hw in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected react-dom, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.