Описание
Cross-Site Scripting in react
Versions of react prior to 0.14.0 are vulnerable to Cross-Site Scripting (XSS). The package's createElement function fails to properly validate its input object, allowing attackers to execute arbitrary JavaScript in a victim's browser.
Recommendation
Upgrade to version 0.14.0 or later.
Пакеты
Наименование
react
npm
Затронутые версииВерсия исправления
>= 0.0.1, < 0.14.0
0.14.0
Дефекты
CWE-79
Дефекты
CWE-79