# CVE-2018-6341: Facebook react-dom cross-site scripting in server rendering

Source: https://junglewise.ai/threats/cve-2018-6341-facebook-react-dom-cross-site-scripting-in-server-rendering  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-01-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2018-6341 · Severity: low · CVSS 3 · Published 2019-01-04

react-dom is a JavaScript library used by web developers to build interactive user interfaces, particularly on the server side. A flaw in how the library handles HTML attribute names allows attackers to inject malicious JavaScript code when an application accepts user input for attribute names and renders it server-side, potentially compromising user sessions or stealing sensitive data from visitors' browsers.

## Quick answers

**Is CVE-2018-6341 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-6341 being exploited in the wild.

**How severe is CVE-2018-6341?** Low severity, with a CVSS score of 3, published 4 January 2019.

**Which products and versions are affected?** React-Dom SEMVER:introduced=16.0.0,fixed=16.0.1.

**Is there a fix for CVE-2018-6341?** Yes. React-Dom: upgrade to 16.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2018-6341 attacked?** It is attacked over the network.

**Am I affected by CVE-2018-6341?** Check whether you run React-Dom at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- React-Dom: upgrade to 16.0.1 or later

## Technical details

The vulnerability is a cross-site scripting (XSS) flaw (CWE-79) in react-dom's server-side rendering (ReactDOMServer) caused by insufficient validation of HTML attribute names. When an application passes unsanitized user input as attribute names in HTML tags during server rendering, an attacker can inject malicious attribute names containing JavaScript (e.g., event handlers). The attack requires three preconditions: server-side React rendering, use of ReactDOMServer, and inclusion of user-controlled attribute names. An unauthenticated attacker can execute arbitrary JavaScript in a victim's browser context with changed scope (affecting resources beyond the vulnerable component). Patches are available: upgrade to react-dom 16.0.1, 16.1.2, 16.2.1, 16.3.3, or 16.4.2 depending on the major version in use.

## Affected products

- Facebook react-dom 16.0.0, 16.1.0 to <16.1.2, 16.2.0, 16.3.0 to <16.3.3, 16.4.0 to <16.4.2

## Identifiers

- CVE-2018-6341
- GHSA-mvjj-gqq2-p4hw

## Timeline

- 2019-01-04: disclosed
- 2018-08-01: patched: Patches released for versions 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2