CVE-2018-6341 Cross-Site Scripting in react-dom
Attackers can execute arbitrary scripts in user browsers via unescaped attribute names in server-rendered React applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-6341?
CVE-2018-6341 is a medium-severity cross-site scripting vulnerability in Facebook react-dom, published on 31 Dec 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2.
Weakness: CWE-79
Which versions are affected by CVE-2018-6341?
10 open source packages ship an affected version, including react-dom. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
react-dom npm | From 16.0.0 | 16.0.1 |
react-dom npm | From 16.0.0 | 16.0.1 |
react-dom npm | From 16.1.0 | 16.1.2 |
react-dom npm | From 16.1.0 | 16.1.2 |
react-dom npm | From 16.2.0 | 16.2.1 |
react-dom npm | From 16.2.0 | 16.2.1 |
4 more packages
react-dom npm | From 16.3.0 | 16.3.3 |
react-dom npm | From 16.3.0 | 16.3.3 |
react-dom npm | From 16.4.0 | 16.4.2 |
react-dom npm | From 16.4.0 | 16.4.2 |
Products include Facebook React.
How do I fix CVE-2018-6341?
Upgrade react-dom to a fixed version for your release line: 16.0.1, 16.1.2, 16.2.1 or 16.3.3.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2018-6341 being exploited?
There is no known exploitation of CVE-2018-6341 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Facebook react-dom
- CVE-2025-55182 Meta React Server Components Remote Code Execution
- CVE-2026-23864 React Server Components have multiple Denial of Service Vulnerabilities
- CVE-2025-55184 Denial of Service Vulnerability in React Server Components
- CVE-2025-67779 Denial of Service Vulnerability in React Server Components
- CVE-2025-55183 Source Code Exposure Vulnerability in React Server Components
Sources
Also known as CLSA-2026-1775521831, CLSA-2026-1792161467, CLSA-2026-1792161489, CLSA-2026-1792267914, CLSA-2026-1792287259, GHSA-mvjj-gqq2-p4hw.