Medium severityGHSA Advisory· Published Sep 4, 2020· Updated Oct 4, 2021
Cross-Site Scripting in react
CVE-2013-7035
Description
Affected versions of react are vulnerable to Cross-Site Scripting (XSS). The package fails to properly sanitize input used to create keys. This may allow attackers to execute arbitrary JavaScript if a key is generated from user input.
Recommendation
If you are using react 0.5.x, upgrade to version 0.5.2 or later. If you are using react 0.4.x, upgrade to version 0.4.2 or later.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
reactnpm | >= 0.4.0, < 0.4.2 | 0.4.2 |
reactnpm | >= 0.5.0, < 0.5.2 | 0.5.2 |
Affected products
2Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-g53w-52xc-2j85ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2013-7035ghsaADVISORY
- github.com/facebook/react/commit/393a889aaceb761f058b09a701f889fa8f8b4e64ghsaWEB
- github.com/facebook/react/commit/94a9a3e752fe089ab23f3a90c26d20d46d62ab10ghsaWEB
- reactjs.org/blog/2013/12/18/react-v0.5.2-v0.4.2.htmlghsaWEB
- snyk.io/vuln/npm:react:20131217ghsaWEB
News mentions
0No linked articles in our index yet.