Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

React's ReactDOMServer Fails to Escape User-Supplied Attribute Names

CVE-2018-6341 · published 7 years ago
Summary

If you're using React to render HTML for your website, and you're using the ReactDOMServer API to do it, you might be open to a security risk. If a user provides data that is used as HTML attributes, it could be manipulated by an attacker to run malicious code on your site. To fix this, update to a fixed version of React, like 16.0.1, 16.1.2, or later.

What to do
  • Update react-bot react-dom to version 16.0.1.
  • Update react-bot react-dom to version 16.1.2.
  • Update react-bot react-dom to version 16.2.1.
  • Update react-bot react-dom to version 16.3.3.
  • Update react-bot react-dom to version 16.4.2.
Affected software
Ecosystem VendorProductAffected versions
npm react-bot react-dom 16.0.0
>= 16.1.0, < 16.1.2
16.2.0
>= 16.3.0, < 16.3.3
>= 16.4.0, < 16.4.2
Fix: upgrade to 16.0.1
– facebook react >= 16.0.0, < 16.0.1
>= 16.1.0, < 16.1.2
>= 16.2.0, < 16.2.1
>= 16.3.0, < 16.3.3
>= 16.4.0, < 16.4.2
cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*
Original advisory text
React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vul...
React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.1 Medium
Exploitation
3% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published31 Dec 2018
Updated23 Oct 2026
First seen6 Mar 2026
Sources
GHSA-mvjj-gqq2-p4hw · GHSA
CVE-2018-6341 · NVD
Track software like this
Free during beta