Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-24474

Dioxus Components has JavaScript injection via user-supplied IDs

Description

Dioxus Components is a shadcn-style component library for the Dioxus app framework. Prior to commit 41e4242ecb1062d04ae42a5215363c1d9fd4e23a, `use_animated_open` formats a string for `eval` with an `id` that can be user supplied. Commit 41e4242ecb1062d04ae42a5215363c1d9fd4e23a patches the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

DioxusLabs components

  • < 41e4242ecb1062d04ae42a5215363c1d9fd4e23aaffected

References