CVE-2018-6341: XSS
First published: Mon Dec 31 2018(Updated: )
Affected versions of `react-dom` are vulnerable to Cross-Site Scripting (XSS). The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by this vulnerability, the application needs to: - be a server-side React app - be rendered to HTML using `ReactDOMServer` - include an attribute name from user input in an HTML tag ## Recommendation If you are using `react-dom` 16.0.x, upgrade to 16.0.1 or later. If you are using `react-dom` 16.1.x, upgrade to 16.1.2 or later. If you are using `react-dom` 16.2.x, upgrade to 16.2.1 or later. If you are using `react-dom` 16.3.x, upgrade to 16.3.3 or later. If you are using `react-dom` 16.4.x, upgrade to 16.4.2 or later.
Credit: cve-assign@fb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/react-dom | >=16.4.0<16.4.2 | 16.4.2 |
| npm/react-dom | >=16.3.0<16.3.3 | 16.3.3 |
| npm/react-dom | =16.2.0 | 16.2.1 |
| npm/react-dom | >=16.1.0<16.1.2 | 16.1.2 |
| React | >=16.0.0<16.0.1 | |
| React | >=16.1.0<16.1.2 | |
| React | >=16.2.0<16.2.1 | |
| React | >=16.3.0<16.3.3 | |
| React | >=16.4.0<16.4.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-6341?
CVE-2018-6341 is considered a medium severity vulnerability due to its potential to allow Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2018-6341?
To fix CVE-2018-6341, update react-dom to version 16.4.2 or later.
Which versions of react-dom are affected by CVE-2018-6341?
Affected versions of react-dom include all versions from 16.0.0 to 16.4.1.
What consequences can result from CVE-2018-6341?
CVE-2018-6341 can lead to the execution of arbitrary JavaScript in the victim's browser, potentially compromising user data.
Is CVE-2018-6341 related to specific use cases in react-dom?
Yes, CVE-2018-6341 affects specific scenarios where the package fails to validate attribute names in HTML tags.
- collector/github-advisory-latest
- alias/GHSA-mvjj-gqq2-p4hw
- alias/CVE-2018-6341
- collector/github-advisory
- agent/references
- agent/type
- agent/weakness
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/author
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- package-manager/npm
- vendor/facebook
- canonical/react
- version/react/16.0.0
- version/react/16.1.0
- version/react/16.2.0
- version/react/16.3.0
- version/react/16.4.0