CVE-2021-23398 Cross-site Scripting (XSS)

MediumCVSS 6.1 EPSS 1.3%

Published: 2021-06-24 18:00
Updated: 2026-06-17 06:38
Exploit status: No public exploit known

Description

All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is returned, leading to dangerouslySetInnerHTML being used, which does not sanitize the output.

Affected products

Product	Affected versions	Fixed in
npm react-bootstrap-table(npm)	<= 4.3.1	No fix listed
react-bootstrap-table project react-bootstrap-table	All versions	No fix listed

References

nvd.nist.gov third-party-advisory
github.com exploit third-party-advisory
github.com broken-link
snyk.io exploit third-party-advisory
snyk.io exploit third-party-advisory
github.com

CVSS v3.1

6.1 Medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Scope: Changed
Confidentiality: Low
Integrity: Low
Availability: None

All scores (5)

v3.1 6.1 · snyk
v3.1 6.1 · nvd@nist.gov
v3.1 6.1 · github
v3.1 6.1 · report@snyk.io
v2.0 4.3 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 1.34% (percentile 71.7)
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.