CVE-2026-113350: react-admin before 5.15.5 Stored XSS via UrlField and FileField
react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type backend fields can execute JavaScript in an administrator's authenticated session when the administrator clicks the rendered link.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to influence URL-type fields in backend records that are rendered through react-admin's UrlField or FileField. Exploitation also requires an administrator to click the attacker-controlled rendered link while authenticated.
Which deployments are affected?
Applications using react-admin versions before 5.15.5 are affected when they render attacker-influenced record values with UrlField or FileField. The provided information does not establish that every default application configuration exposes such fields.
What should be done if an immediate upgrade is not possible?
Prevent untrusted users from supplying javascript: URIs in backend URL-type fields, and avoid rendering untrusted values through UrlField or FileField. Review existing stored URL values for javascript: schemes and remove or replace them.
How can we determine whether we may already be exposed?
Check whether the application uses a react-admin version earlier than 5.15.5 and whether UrlField or FileField renders record fields that users or untrusted integrations can modify. Inspect those stored fields for javascript: URI values.