Executive brief
React, a popular JavaScript library for building web applications, failed to properly sanitize user input when generating component keys. This vulnerability allows attackers to inject malicious JavaScript that executes in the context of users' browsers, potentially stealing session tokens, modifying page content, or redirecting users to phishing sites.
Technical details
React versions 0.4.0–0.4.1 and 0.5.0–0.5.1 contain a cross-site scripting (XSS) vulnerability in the ReactTextComponent module. The rootID parameter was not properly escaped when constructing the HTML span element, allowing attacker-controlled input to break out of HTML attributes and inject arbitrary JavaScript. The vulnerability requires user interaction (rendering a component with attacker-supplied keys) but does not require authentication. The fix escapes the rootID using the escapeTextForBrowser function before embedding it in HTML. Patches are available in React 0.4.2 and 0.5.2.
Affected products
- Meta React 0.4.0–0.4.1, 0.5.0–0.5.1
Timeline
- 2013-12-18: disclosed: React 0.4.2 and 0.5.2 released with fixes
- 2020-09-04: advisory