Packages / react / Security

HighVulnerabilityGHSA-hg79-j56m-fxgvPublished 4 Sep 2020

Cross-Site Scripting in react

Affected releases · react

  • 0.13.x and older0.0.1 – 0.13.3No fix, no longer updated

0.13.x has no fix yet; the newest fixed line:

npm install react@0.14.0
19.x

  1. Not affected

    19.0.0 – 19.3.1

    33 releases, latest

0.x

  1. Affected

    0.0.1 – 0.13.3

    36 releases

  2. Fixed

    0.14.0 – 0.14.10

    11 releases

143 stable releases of react, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for react. It is read in your browser and sent nowhere.

What happens

Versions of react prior to 0.14.0 are vulnerable to Cross-Site Scripting (XSS). The package's createElement function fails to properly validate its input object, allowing attackers to execute arbitrary JavaScript in a victim's browser.

Recommendation

Upgrade to version 0.14.0 or later.