Cross-Site Scripting

Overview Affected versions of react-dom are vulnerable to Cross-Site Scripting XSS. The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be...

@activelylearn/react-pdf (2.5.2), @aglet/components (>=1.3.3, <=2.0.1) +330 more potentially affected by CVE-2018-6341 via react-dom (16.2.0)

react-dom NPM version 16.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on react-dom and may be impacted: - @activelylearn/react-pdf 2.5.2 - @aglet/components =1.3.3, =0.1.1-alpha.0, =1.0.5, =0.0.1, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =0.1.0, =3.0.4,...

@anujboddu/searchbar (>=2.0.0, <=2.1.1), @dlghq/dialog-components (>=0.146.0, <=0.149.7) +42 more potentially affected by CVE-2018-6341 via react-dom (>=16.1.0, <=16.1.1)

react-dom NPM version =16.1.0, =2.0.0, =0.146.0, =4.0.1, =0.0.7, =1.0.0, =1.0.0, =1.1.0, =1.3.9, =1.1.10, =1.0.6, =0.0.12, =0.1.0, =3.6.3, =3.7.4 and more Source cves: CVE-2018-6341 Source advisory: OSV:GHSA-MVJJ-GQQ2-P4HW...

@akiolabs/analytics (>=0.0.3, <=0.0.4), @akiolabs/app (>=0.0.2, <=0.0.4) +221 more potentially affected by CVE-2018-6341 via react-dom (>=16.4.0, <=16.4.1)

react-dom NPM version =16.4.0, =0.0.3, =0.0.2, =0.0.1, =2018.5.24-0, =2018.6.17-2, =2018.7.11-0, =0.4.1, =0.1.0-latest.1a450bb3, =1.0.0-beta.0, =0.0.2, =0.0.22-alpha.1, =1.1.0, =1.0.0, =1.6.1 and more Source cves: CVE-2018-6341 Source advisory: OSV:GHSA-MVJJ-GQQ2-P4HW...

@amory/patch-gatsby (>=2018.4.29-8, <=2018.5.11-5), @amory/patches (>=2018.5.11-6, <=2018.5.23-7) +227 more potentially affected by CVE-2018-6341 via react-dom (>=16.3.0, <=16.3.2)

react-dom NPM version =16.3.0, =2018.4.29-8, =2018.5.11-6, =2.0.0-rc.2, =0.0.5, =0.0.1, =1.9.1, =1.3.2, =1.6.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.3.2, =1.1.0, =1.1.3 and more Source cves: CVE-2018-6341 Source advisory: OSV:GHSA-MVJJ-GQQ2-P4HW...

GHSA-MVJJ-GQQ2-P4HW Cross-Site Scripting in react-dom

Affected versions of react-dom are vulnerable to Cross-Site Scripting XSS. The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by...

PT-2018-17489

Name of the Vulnerable Software and Affected Versions react-dom versions 16.0.0 through 16.0.0 react-dom versions 16.1.0 through 16.1.1 react-dom versions 16.2.0 through 16.2.0 react-dom versions 16.3.0 through 16.3.2 react-dom versions 16.4.0 through 16.4.1 Description The issue is related to a...