Executive brief
React is a widely-used JavaScript library for building web user interfaces. Versions before 0.14.0 contain a Cross-Site Scripting (XSS) vulnerability in the createElement function that fails to properly validate input, allowing attackers to inject and execute malicious JavaScript code in users' browsers. This could lead to session hijacking, credential theft, or malware distribution.
Technical details
The vulnerability is a Cross-Site Scripting (CWE-79) flaw in React's createElement function prior to version 0.14.0. The function fails to properly validate its input object, allowing attackers to craft malicious React elements containing executable JavaScript. The attack requires the ability to control the input to createElement, which could occur through user-supplied data rendered by an application. No authentication or special privileges are required to trigger the vulnerability if the application passes untrusted data to createElement. An attacker can execute arbitrary JavaScript in the victim's browser context, potentially accessing sensitive data or performing actions on behalf of the user. The vulnerability was fixed in React 0.14.0, released on October 7, 2015.
Affected products
- Facebook React before 0.14.0
Timeline
- 2020-09-04: disclosed
- 2015-10-07: patched: Fixed in React 0.14.0