Executive brief
@refinedev/inferencer is a code-generation tool used by developers to automatically create admin panels and data management UIs in React applications. The tool fails to properly escape field names from JSON data sources when generating JavaScript code, allowing attackers who control the data provider to inject malicious code that executes in the developer's browser during code generation.
Technical details
The vulnerability is a code injection flaw in the JSX source code generation logic of @refinedev/inferencer. The tool interpolates API field names directly into generated JSX/JavaScript without escaping them, allowing an attacker controlling the data provider to inject arbitrary JavaScript through crafted JSON property names. When the Inferencer renders and generates code based on this malicious data, the injected JavaScript executes in the developer's browser context. This is a supply chain attack that targets developers during the code generation phase. The vulnerability affects all versions through 7.0.0.
Affected products
- refinedev @refinedev/inferencer through 7.0.0
Timeline
- 2026-09-16: disclosed