@akiolabs/analytics (>=0.0.3, <=0.0.4), @akiolabs/app (>=0.0.2, <=0.0.4) +221 more potentially affected by CVE-2018-6341 via react-dom (>=16.4.0, <=16.4.1)

react-dom NPM version =16.4.0, =0.0.3, =0.0.2, =0.0.1, =2018.5.24-0, =2018.6.17-2, =2018.7.11-0, =0.4.1, =0.1.0-latest.1a450bb3, =1.0.0-beta.0, =0.0.2, =0.0.22-alpha.1, =1.1.0, =1.0.0, =1.6.1 and more Source cves: CVE-2018-6341 Source advisory: OSV:GHSA-MVJJ-GQQ2-P4HW...

@akiolabs/analytics (>=0.0.3, <=0.0.4), @akiolabs/app (>=0.0.2, <=0.0.4) +221 more potentially affected by CVE-2018-6341 via react-dom (>=16.4.0, <=16.4.1)

react-dom NPM version =16.4.0, =0.0.3, =0.0.2, =0.0.1, =2018.5.24-0, =2018.6.17-2, =2018.7.11-0, =0.4.1, =0.1.0-latest.1a450bb3, =1.0.0-beta.0, =0.0.2, =0.0.22-alpha.1, =1.1.0, =1.0.0, =1.6.1 and more Source cves: CVE-2018-6341 Source advisory: GHSA-MVJJ-GQQ2-P4HW...

@amory/patch-gatsby (>=2018.4.29-8, <=2018.5.11-5), @amory/patches (>=2018.5.11-6, <=2018.5.23-7) +227 more potentially affected by CVE-2018-6341 via react-dom (>=16.3.0, <=16.3.2)

react-dom NPM version =16.3.0, =2018.4.29-8, =2018.5.11-6, =2.0.0-rc.2, =0.0.5, =0.0.1, =1.9.1, =1.3.2, =1.6.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.3.2, =1.1.0, =1.1.3 and more Source cves: CVE-2018-6341 Source advisory: GHSA-MVJJ-GQQ2-P4HW...

@anujboddu/searchbar (>=2.0.0, <=2.1.1), @dlghq/dialog-components (>=0.146.0, <=0.149.7) +42 more potentially affected by CVE-2018-6341 via react-dom (>=16.1.0, <=16.1.1)

react-dom NPM version =16.1.0, =2.0.0, =0.146.0, =4.0.1, =0.0.7, =1.0.0, =1.0.0, =1.1.0, =1.3.9, =1.1.10, =1.0.6, =0.0.12, =0.1.0, =3.6.3, =3.7.4 and more Source cves: CVE-2018-6341 Source advisory: GHSA-MVJJ-GQQ2-P4HW...

GHSA-MVJJ-GQQ2-P4HW Cross-Site Scripting in react-dom

Affected versions of react-dom are vulnerable to Cross-Site Scripting XSS. The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by...

GHSA-29GP-92WP-94Q8 react-dev-utils on Windows vulnerable to Remote Code Execution

react-dev-utils on Windows is vulnerable to remote code execution. Recommendation Update to one of the following versions, depending on the release line that you are using. - 1.0.4 - 2.0.2 - 3.1.2 - 4.2.2 - 5.0.2 - 6.0.0-next.a671462c...

@5minutes2start/react-scripts (>=1.1.2, <=1.1.4), @biko/react-scripts (>=0.1.0, <=0.4.0) +132 more potentially affected by CVE-2018-6342 via react-dev-utils (>=4.0.0, <=4.2.1)

react-dev-utils NPM version =4.0.0, =1.1.2, =0.1.0, =0.8.12, =0.1.0, =0.0.1, =2.13.0, =2.14.0, =0.2.0, =0.3.0, =0.2.2, =0.2.10-SNAPSHOT.481, =0.2.10-SNAPSHOT.673 - @leizeng/react-scripts-ts 2.13.0 and more Source cves: CVE-2018-6342 Source advisory: OSV:GHSA-29GP-92WP-94Q8...

@1337lawyers/design (>=0.1.0, <=0.1.38), @9188/w-cli (>=1.0.0, <=1.0.4) +50 more potentially affected by CVE-2018-6342 via react-dev-utils (>=5.0.0, <=5.0.1)

react-dev-utils NPM version =5.0.0, =0.1.0, =1.0.0, =0.4.1, =0.1.0-latest.1a450bb3, =1.0.5, =1.0.0-beta.28, =1.0.1, =1.0.0, =1.0.0, =0.26.4, =0.0.0-legacy, =3.10.0-beta.0, =0.1.0-alpha.0, =2.1.16, =2.3.5 - aqxy-common-ui 0.0.1 and more Source cves: CVE-2018-6342 Source advisory:...

@enact/cli (>=0.9.6, <=0.9.8), abt.api.web (0.0.3) +26 more potentially affected by CVE-2018-6342 via react-dev-utils (>=3.0.0, <=3.1.1)

react-dev-utils NPM version =3.0.0, =0.9.6, =4.2.0, =1.5.1, =0.15.0, =0.7.0, =0.7.0, =0.1.0, =0.1.4, =1.9.2, =0.0.1, =0.0.1, =0.0.3 and more Source cves: CVE-2018-6342 Source advisory: OSV:GHSA-29GP-92WP-94Q8...

@yaochuxia/roadhog (1.0.9), svmx-react-scripts (>=1.1.4, <=1.1.17) +1 more potentially affected by CVE-2018-6342 via react-dev-utils (2.0.1)

react-dev-utils NPM version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on react-dev-utils and may be impacted: - @yaochuxia/roadhog 1.0.9 - svmx-react-scripts =1.1.4, =0.1.0, =0.1.1 Source cves: CVE-2018-6342 Source advisory:...

@enact/cli (>=0.9.6, <=0.9.8), abt.api.web (0.0.3) +26 more potentially affected by CVE-2018-6342 via react-dev-utils (>=3.0.0, <=3.1.1)

react-dev-utils NPM version =3.0.0, =0.9.6, =4.2.0, =1.5.1, =0.15.0, =0.7.0, =0.7.0, =0.1.0, =0.1.4, =1.9.2, =0.0.1, =0.0.1, =0.0.3 and more Source cves: CVE-2018-6342 Source advisory: GHSA-29GP-92WP-94Q8...

@1337lawyers/design (>=0.1.0, <=0.1.38), @9188/w-cli (>=1.0.0, <=1.0.4) +50 more potentially affected by CVE-2018-6342 via react-dev-utils (>=5.0.0, <=5.0.1)

react-dev-utils NPM version =5.0.0, =0.1.0, =1.0.0, =0.4.1, =0.1.0-latest.1a450bb3, =1.0.5, =1.0.0-beta.28, =1.0.1, =1.0.0, =1.0.0, =0.26.4, =0.0.0-legacy, =3.10.0-beta.0, =0.1.0-alpha.0, =2.1.16, =2.3.5 - aqxy-common-ui 0.0.1 and more Source cves: CVE-2018-6342 Source advisory: GHSA-29GP-92WP-94...

@yaochuxia/roadhog (1.0.9), svmx-react-scripts (>=1.1.4, <=1.1.17) +1 more potentially affected by CVE-2018-6342 via react-dev-utils (2.0.1)

react-dev-utils NPM version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on react-dev-utils and may be impacted: - @yaochuxia/roadhog 1.0.9 - svmx-react-scripts =1.1.4, =0.1.0, =0.1.1 Source cves: CVE-2018-6342 Source advisory: GHSA-29GP-92WP-94Q...

@5minutes2start/react-scripts (>=1.1.2, <=1.1.4), @biko/react-scripts (>=0.1.0, <=0.4.0) +132 more potentially affected by CVE-2018-6342 via react-dev-utils (>=4.0.0, <=4.2.1)

react-dev-utils NPM version =4.0.0, =1.1.2, =0.1.0, =0.8.12, =0.1.0, =0.0.1, =2.13.0, =2.14.0, =0.2.0, =0.3.0, =0.2.2, =0.2.10-SNAPSHOT.481, =0.2.10-SNAPSHOT.673 - @leizeng/react-scripts-ts 2.13.0 and more Source cves: CVE-2018-6342 Source advisory: GHSA-29GP-92WP-94Q8...

react-dev-utils on Windows vulnerable to Remote Code Execution

react-dev-utils on Windows is vulnerable to remote code execution. Recommendation Update to one of the following versions, depending on the release line that you are using. - 1.0.4 - 2.0.2 - 3.1.2 - 4.2.2 - 5.0.2 - 6.0.0-next.a671462c...

2muchcoffee-react-scripts (0.1.0), 2muchcoffee-react-scripts2 (>=0.1.0, <=0.1.2) +993 more potentially affected by CVE-2018-14732 via webpack-dev-server (>=3.0.0, <=3.1.10)

webpack-dev-server NPM version =3.0.0, =0.1.0, =0.6.2, =2.1.1, =0.1.0, =1.0.0, =2.1.0-beta.0, =2.1.0-beta.0, =2.1.2-4, =2.2.0-beta.1, =1.0.0, =0.8.8, =0.12.0 and more Source cves: CVE-2018-14732 Source advisory: OSV:GHSA-CF66-XWFP-GVC4...

2muchcoffee-react-scripts (0.1.0), 2muchcoffee-react-scripts2 (>=0.1.0, <=0.1.2) +993 more potentially affected by CVE-2018-14732 via webpack-dev-server (>=3.0.0, <=3.1.10)

webpack-dev-server NPM version =3.0.0, =0.1.0, =0.6.2, =2.1.1, =0.1.0, =1.0.0, =2.1.0-beta.0, =2.1.0-beta.0, =2.1.2-4, =2.2.0-beta.1, =1.0.0, =0.8.8, =0.12.0 and more Source cves: CVE-2018-14732 Source advisory: GHSA-CF66-XWFP-GVC4...

Cross site scripting

React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was...

CVE-2018-6341

React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was...

CVE-2018-6341

React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was...