react-dom is vulnerable to cross-site scripting (XSS) attacks. The library does not properly sanitize the attribute name in server applications, allowing a malicious user to inject and execute arbitrary Javascript. This does not affect client-rendered applications.