Description
react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type backend fields can execute JavaScript in an administrator's authenticated session when the administrator clicks the rendered link.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
marmelab react-admin
Default version status: unaffected
0 to < 5.15.5affected
pkg:npm/react-adminReferences
- https://github.com/marmelab/react-admin/issues/11408 ↗
- https://github.com/marmelab/react-admin/commit/d20820a05dc8094d322ffa3f0bd9800501acb0a8 ↗
- https://github.com/marmelab/react-admin/releases/tag/v5.15.5 ↗
- https://github.com/marmelab/react-admin/blob/3119d7e56c178e699a2247b67868a4613039ffc3/packages/ra-ui-materialui/src/field/UrlField.tsx ↗
- https://www.vulncheck.com/advisories/react-admin-before-5.15.5-stored-xss-via-urlfield-and-filefield ↗