CVE Feed

    Dashboard / CVE / CVE-2018-6341

    CVE-2018-6341

    React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2.

    Published:Dec 31, 2018
    Last Modified:May 6, 2025
    EPS:Dec 31, 2018
    EPSS Score:0.1785
    CVSS Score:6.1

    Affected Products

    Vendor
    Facebook
    Product
    React

    Exploits

    https://github.com/diwangs/react16-ssr

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High