GHSA-hg79-j56m-fxgv Cross-Site Scripting in react
Attackers can execute arbitrary JavaScript in victims' browsers via improper input validation in the React createElement function.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-hg79-j56m-fxgv?
GHSA-hg79-j56m-fxgv is a cross-site scripting vulnerability in react, published on 4 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Versions of react prior to 0.14.0 are vulnerable to Cross-Site Scripting (XSS). The package's createElement function fails to properly validate its input object, allowing attackers to execute arbitrary JavaScript in a victim's browser.
Recommendation
Upgrade to version 0.14.0 or later.
Which versions are affected by GHSA-hg79-j56m-fxgv?
2 open source packages ship an affected version, including react.
| Package | Affected | Fixed in |
|---|---|---|
react npm | From 0.0.1 | 0.14.0 |
react npm | From 0.0.1 | 0.14.0 |
How do I fix GHSA-hg79-j56m-fxgv?
Upgrade react to 0.14.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-hg79-j56m-fxgv being exploited?
There is no known exploitation of GHSA-hg79-j56m-fxgv in the wild and no public exploit code.