PT-2020-21338 · Facebook · React

Published 2020-09-04 · Updated 2020-09-04

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions react versions prior to 0.14.0

Description The issue arises from the createElement function's failure to properly validate its input object, allowing attackers to execute arbitrary JavaScript in a victim's browser, thus facilitating Cross-Site Scripting (XSS) attacks.

Recommendations Upgrade to version 0.14.0 or later.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-HG79-J56M-FXGV

Affected Products

React

References · 7

• https://osv.dev/vulnerability/GHSA-hg79-j56m-fxgv · Vendor Advisory
• https://github.com/facebook/react · Note
• https://npmjs.com/advisories/1347 · Note
• https://reactjs.org/blog/2015/10/07/react-v0.14.html#notable-enhancements · Note
• http://danlec.com/blog/xss-via-a-spoofed-react-element · Note
• https://reactjs.org/blog/2019/10/22/react-release-channels.html#experimental-channel · Note
• https://snyk.io/vuln/npm:react:20150318 · Note