CVE-2013-7035
Cross-Site Scripting in react
Affected versions of react are vulnerable to Cross-Site Scripting (XSS). The package fails to properly sanitize input used to create keys. This may allow attackers to execute arbitrary JavaScript if a key is generated from user input.
Recommendation
If you are using react 0.5.x, upgrade to version 0.5.2 or later.
If you are using react 0.4.x, upgrade to version 0.4.2 or later.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
What each source reports
GitHub Advisories Score usedGHSA-g53w-52xc-2j85
Cross-Site Scripting in react
Affected versions of react are vulnerable to Cross-Site Scripting (XSS). The package fails to properly sanitize input used to create keys. This may allow attackers to execute arbitrary JavaScript if a key is generated from user input.
Recommendation
If you are using react 0.5.x, upgrade to version 0.5.2 or later.
If you are using react 0.4.x, upgrade to version 0.4.2 or later.
- Record
GHSA-g53w-52xc-2j85- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-g53w-52xc-2j85
Cross-Site Scripting in react
Affected versions of react are vulnerable to Cross-Site Scripting (XSS). The package fails to properly sanitize input used to create keys. This may allow attackers to execute arbitrary JavaScript if a key is generated from user input.
Recommendation
If you are using react 0.5.x, upgrade to version 0.5.2 or later.
If you are using react 0.4.x, upgrade to version 0.4.2 or later.
- Record
GHSA-g53w-52xc-2j85- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-7035 is a medium vulnerability (CVSS 6.5) in react, published September 4, 2020. No source lists public exploit code. Fixed in react 0.4.2.
References
reactjs.org/blog/2013/12/18/react-v0.5.2-v0.4.2.html
snyk.io/vuln/npm:react:20131217
nvd.nist.gov/vuln/detail/CVE-2013-7035
github.com/facebook/react/commit/393a889aaceb761f058b09a701f889fa8f8b4e64