Skip to content

Product

npm react vulnerabilities

2 published CVES affecting npm react, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
0
Medium
1
Low
0
Unscored
1
CISA KEV
0

Latest npm react CVEs

Newest publication first

  1. GHSA-hg79-j56m-fxgv Cross-Site Scripting in react

    Published
    Unknown

    Versions of react prior to 0.14.0 are vulnerable to Cross-Site Scripting (XSS). The package's createElement function fails to properly validate its input object, allowing attackers to execute arbitrary JavaScript in a victim's browser. Recommendation Upgrade to version 0.14.0 or...

  2. CVE-2013-7035 Cross-Site Scripting in react

    MediumCVSS 6.5

    Affected versions of react are vulnerable to Cross-Site Scripting (XSS). The package fails to properly sanitize input used to create keys. This may allow attackers to execute arbitrary JavaScript if a key is generated from user input. Recommendation If you are using react 0.5.x,...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.