# CVE-2013-7035: React cross-site scripting in key generation

Source: https://junglewise.ai/threats/cve-2013-7035-react-cross-site-scripting-in-key-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-09-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2013-7035 · Severity: low · CVSS 3.1 · Published 2020-09-04

React, a popular JavaScript library for building web applications, failed to properly sanitize user input when generating component keys. This vulnerability allows attackers to inject malicious JavaScript that executes in the context of users' browsers, potentially stealing session tokens, modifying page content, or redirecting users to phishing sites.

Technologies: [React](https://junglewise.ai/threats/technologies/npm-react).

## Quick answers

**Is CVE-2013-7035 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2013-7035 being exploited in the wild.

**How severe is CVE-2013-7035?** Low severity, with a CVSS score of 3.1, published 4 September 2020.

**Which products and versions are affected?** React SEMVER:introduced=0.4.0,fixed=0.4.2.

**Is there a fix for CVE-2013-7035?** Yes. React: upgrade to 0.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2013-7035 attacked?** It is attacked over the network.

**Am I affected by CVE-2013-7035?** Check whether you run React at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- React: upgrade to 0.4.2 or later

## Technical details

React versions 0.4.0–0.4.1 and 0.5.0–0.5.1 contain a cross-site scripting (XSS) vulnerability in the ReactTextComponent module. The rootID parameter was not properly escaped when constructing the HTML span element, allowing attacker-controlled input to break out of HTML attributes and inject arbitrary JavaScript. The vulnerability requires user interaction (rendering a component with attacker-supplied keys) but does not require authentication. The fix escapes the rootID using the escapeTextForBrowser function before embedding it in HTML. Patches are available in React 0.4.2 and 0.5.2.

## Affected products

- Meta React 0.4.0–0.4.1, 0.5.0–0.5.1

## Identifiers

- CVE-2013-7035
- GHSA-g53w-52xc-2j85

## Timeline

- 2013-12-18: disclosed: React 0.4.2 and 0.5.2 released with fixes
- 2020-09-04: advisory

## References

- [https://github.com/facebook/react/commit/393a889aaceb761f058b09a701f889fa8f8b4e64](https://github.com/facebook/react/commit/393a889aaceb761f058b09a701f889fa8f8b4e64)

## Related threats

- [MAL-2024-2929 - Malicious code in react (npm)](https://junglewise.ai/threats/malicious-code-in-react-npm-f16bb2dd)
- [React Cross-Site Scripting in createElement](https://junglewise.ai/threats/react-cross-site-scripting-in-createelement-6e7de634)