Cross-site Scripting (XSS)

2023-02-1403:19:04

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site scripting

vulnerability

richtextfield

javascript

react applications

EPSS

0.001

Percentile

42.2%

JSON

react-admin is vulnerable to Cross-site Scripting (XSS). The vulnerability exists because the dangerouslySetInnerHTML attribute in RichTextField.tsx does not sanitize on the client side. If the data isn’t sanitized server-side, the RichTextField attribute allows an attacker to inject and execute malicious javascript in all React applications built with the ``.