Description
react-admin is a frontend framework for building browser applications on top of REST/GraphQL APIs. react-admin prior to versions 3.19.12 and 4.7.6, along with ra-ui-materialui prior to 3.19.12 and 4.7.6, are vulnerable to cross-site scripting. All React applications built with react-admin and using the `
Remediation
References
https://github.com/marmelab/react-admin/pull/8644
https://github.com/marmelab/react-admin/pull/8645
https://github.com/marmelab/react-admin/releases/tag/v3.19.12
https://github.com/marmelab/react-admin/releases/tag/v4.7.6
https://github.com/marmelab/react-admin/security/advisories/GHSA-5jcr-82fh-339v
Related Vulnerabilities
CVE-2020-28502 Vulnerability in maven package org.webjars.npm:xmlhttprequest
CVE-2023-4853 Vulnerability in maven package io.quarkus:quarkus-keycloak-authorization
CVE-2023-48910 Vulnerability in maven package io.github.microcks:microcks
CVE-2022-0239 Vulnerability in maven package edu.stanford.nlp:stanford-corenlp