Packages / react / Security

ModerateVulnerabilityGHSA-g53w-52xc-2j85CVE-2013-7035Published 4 Sep 2020

Cross-Site Scripting in react

Affected releases · react

  • 0.5.x0.5.0 – 0.5.1Fixed in 0.5.2

On 0.5.x, the newest line:

npm install react@0.5.2
19.x

  1. Not affected

    19.0.0 – 19.3.1

    33 releases, latest

0.x

  1. Not affected

    0.0.1 – 0.3.5

    14 releases

  2. Affected

    0.5.0 – 0.5.1

    2 releases

  3. Fixed

    0.5.2 – 0.14.10

    31 releases

143 stable releases of react, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for react. It is read in your browser and sent nowhere.

What happens

Affected versions of react are vulnerable to Cross-Site Scripting (XSS). The package fails to properly sanitize input used to create keys. This may allow attackers to execute arbitrary JavaScript if a key is generated from user input.

Recommendation

If you are using react 0.5.x, upgrade to version 0.5.2 or later. If you are using react 0.4.x, upgrade to version 0.4.2 or later.