CVE-2018-6341
Cross-Site Scripting in react-dom
React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List
React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2.
- Record
CVE-2018-6341- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2019-0190
React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2.
- Record
EUVD-2019-0190- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mvjj-gqq2-p4hw
Cross-Site Scripting in react-dom
Affected versions of react-dom are vulnerable to Cross-Site Scripting (XSS). The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by this vulnerability, the application needs to:
- be a server-side React app
- be rendered to HTML using
ReactDOMServer - include an attribute name from user input in an HTML tag
Recommendation
If you are using react-dom 16.0.x, upgrade to 16.0.1 or later.
If you are using react-dom 16.1.x, upgrade to 16.1.2 or later.
If you are using react-dom 16.2.x, upgrade to 16.2.1 or later.
If you are using react-dom 16.3.x, upgrade to 16.3.3 or later.
If you are using react-dom 16.4.x, upgrade to 16.4.2 or later.
- Record
GHSA-mvjj-gqq2-p4hw- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2.
- Record
CVE-2018-6341- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2.
- Record
CVE-2018-6341- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-mvjj-gqq2-p4hw
Cross-Site Scripting in react-dom
Affected versions of react-dom are vulnerable to Cross-Site Scripting (XSS). The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by this vulnerability, the application needs to:
- be a server-side React app
- be rendered to HTML using
ReactDOMServer - include an attribute name from user input in an HTML tag
Recommendation
If you are using react-dom 16.0.x, upgrade to 16.0.1 or later.
If you are using react-dom 16.1.x, upgrade to 16.1.2 or later.
If you are using react-dom 16.2.x, upgrade to 16.2.1 or later.
If you are using react-dom 16.3.x, upgrade to 16.3.3 or later.
If you are using react-dom 16.4.x, upgrade to 16.4.2 or later.
- Record
GHSA-mvjj-gqq2-p4hw- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Show 5 moreShow less
OSVCLSA-2026-1775521831 No score
TuxCare security update for 2 packages (1 CVE)
TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 16.4.1-tuxcare.1.
- Record
CLSA-2026-1775521831- Updated
- 2026-11-02
OSVCLSA-2026-1792161467 No score
TuxCare security update for react-art (1 CVE)
TuxCare rebuilt react-art to address 1 CVE. Fixed in 16.4.1-tuxcare.1.
- Record
CLSA-2026-1792161467- Updated
- 2026-11-02
OSVCLSA-2026-1792161489 No score
TuxCare security update for react-is (1 CVE)
TuxCare rebuilt react-is to address 1 CVE. Fixed in 16.4.1-tuxcare.1.
- Record
CLSA-2026-1792161489- Updated
- 2026-11-02
OSVCLSA-2026-1792267914 No score
TuxCare security update for react-dom (1 CVE)
TuxCare rebuilt react-dom to address 1 CVE. Fixed in 16.4.1-tuxcare.1.
- Record
CLSA-2026-1792267914- Updated
- 2026-11-02
OSVCLSA-2026-1792287259 No score
TuxCare security update for react-test-renderer (1 CVE)
TuxCare rebuilt react-test-renderer to address 1 CVE. Fixed in 16.4.1-tuxcare.1.
- Record
CLSA-2026-1792287259- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
react-domnpm |
16.0.0 to 16.0.0 | 16.0.1 |
react-domnpm |
16.1.0 up to 16.1.2 | 16.1.2 |
react-domnpm |
16.2.0 to 16.2.0 | 16.2.1 |
react-domnpm |
16.3.0 up to 16.3.3 | 16.3.3 |
react-domnpm |
16.4.0 up to 16.4.2 | 16.4.2 |
create-subscriptionTuxCare:npm |
16.4.1-tuxcare.0 up to 16.4.1-tuxcare.1, plus listed versions 16.4.1 |
16.4.1-tuxcare.1 |
reactTuxCare:npm |
16.4.1-tuxcare.0 up to 16.4.1-tuxcare.1, plus listed versions 16.4.1 |
16.4.1-tuxcare.1 |
react-artTuxCare:npm |
16.4.1-tuxcare.0 up to 16.4.1-tuxcare.1, plus listed versions 16.4.1 |
16.4.1-tuxcare.1 |
react-isTuxCare:npm |
16.4.1-tuxcare.0 up to 16.4.1-tuxcare.1, plus listed versions 16.4.1 |
16.4.1-tuxcare.1 |
react-domTuxCare:npm |
16.4.1-tuxcare.0 up to 16.4.1-tuxcare.1, plus listed versions 16.4.1 |
16.4.1-tuxcare.1 |
react-test-rendererTuxCare:npm |
16.4.1-tuxcare.0 up to 16.4.1-tuxcare.1, plus listed versions 16.4.1 |
16.4.1-tuxcare.1 |
react-domnpm |
16.0.0 up to 16.0.1 | 16.0.1 |
react-domnpm |
16.2.0 up to 16.2.1 | 16.2.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | diwangs/react16-ssr | 2023-03-20 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-6341 is a medium vulnerability (CVSS 6.1) in Facebook React, published December 31, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.43%, the 88th percentile. Fixed in react-dom 16.0.1.