Описание
Cross-Site Scripting in react-dom
Affected versions of react-dom are vulnerable to Cross-Site Scripting (XSS). The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by this vulnerability, the application needs to:
- be a server-side React app
- be rendered to HTML using
ReactDOMServer - include an attribute name from user input in an HTML tag
Recommendation
If you are using react-dom 16.0.x, upgrade to 16.0.1 or later.
If you are using react-dom 16.1.x, upgrade to 16.1.2 or later.
If you are using react-dom 16.2.x, upgrade to 16.2.1 or later.
If you are using react-dom 16.3.x, upgrade to 16.3.3 or later.
If you are using react-dom 16.4.x, upgrade to 16.4.2 or later.
Пакеты
react-dom
= 16.0.0
16.0.1
react-dom
>= 16.1.0, < 16.1.2
16.1.2
react-dom
= 16.2.0
16.2.1
react-dom
>= 16.3.0, < 16.3.3
16.3.3
react-dom
>= 16.4.0, < 16.4.2
16.4.2
Связанные уязвимости
React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2.