{"id":"CVE-2018-6341","aliases":["CLSA-2026-1775521831","CLSA-2026-1792161467","CLSA-2026-1792161489","CLSA-2026-1792267914","CLSA-2026-1792287259","EUVD-2019-0190","GHSA-mvjj-gqq2-p4hw"],"status":"published","title":"Cross-Site Scripting in react-dom","description":"React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03426,"percentile":0.88997,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2018-12-31T22:00:00Z","modified":"2026-10-24T10:30:37Z","exploits":[{"source":"pocgithub","id":"diwangs/react16-ssr","title":"diwangs/react16-ssr","date":"2023-03-20","url":"https://github.com/diwangs/react16-ssr"}],"fixes":[{"ecosystem":"npm","package":"react-dom","fixed_in":["16.0.1","16.1.2","16.2.1","16.3.3","16.4.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"create-subscription","fixed_in":["16.4.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"react","fixed_in":["16.4.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"react-art","fixed_in":["16.4.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"react-is","fixed_in":["16.4.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"react-dom","fixed_in":["16.4.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"react-test-renderer","fixed_in":["16.4.1-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"react-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0"},{"last_affected":"16.0.0"},{"fixed":"16.0.1"}]}],"versions":["16.0.0"]},{"source":"ghsa","ecosystem":"npm","package":"react-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.1.0"},{"fixed":"16.1.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"react-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.2.0"},{"last_affected":"16.2.0"},{"fixed":"16.2.1"}]}],"versions":["16.2.0"]},{"source":"ghsa","ecosystem":"npm","package":"react-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.3.0"},{"fixed":"16.3.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"react-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.4.0"},{"fixed":"16.4.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-subscription","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.4.1-tuxcare.0"},{"fixed":"16.4.1-tuxcare.1"}]}],"versions":["16.4.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.4.1-tuxcare.0"},{"fixed":"16.4.1-tuxcare.1"}]}],"versions":["16.4.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-art","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.4.1-tuxcare.0"},{"fixed":"16.4.1-tuxcare.1"}]}],"versions":["16.4.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-is","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.4.1-tuxcare.0"},{"fixed":"16.4.1-tuxcare.1"}]}],"versions":["16.4.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.4.1-tuxcare.0"},{"fixed":"16.4.1-tuxcare.1"}]}],"versions":["16.4.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"react-test-renderer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.4.1-tuxcare.0"},{"fixed":"16.4.1-tuxcare.1"}]}],"versions":["16.4.1"]},{"source":"osv","ecosystem":"npm","package":"react-dom","ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0"},{"fixed":"16.0.1"}]}],"versions":["16.0.0"]},{"source":"osv","ecosystem":"npm","package":"react-dom","ranges":[{"type":"SEMVER","events":[{"introduced":"16.1.0"},{"fixed":"16.1.2"}]}]},{"source":"osv","ecosystem":"npm","package":"react-dom","ranges":[{"type":"SEMVER","events":[{"introduced":"16.2.0"},{"fixed":"16.2.1"}]}],"versions":["16.2.0"]},{"source":"osv","ecosystem":"npm","package":"react-dom","ranges":[{"type":"SEMVER","events":[{"introduced":"16.3.0"},{"fixed":"16.3.3"}]}]},{"source":"osv","ecosystem":"npm","package":"react-dom","ranges":[{"type":"SEMVER","events":[{"introduced":"16.4.0"},{"fixed":"16.4.2"}]}]}],"products":[{"vendor":"facebook","product":"react"},{"vendor":"facebook","product":"react-dom"}],"references":[{"url":"https://reactjs.org/blog/2018/08/01/react-v-16-4-2.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://twitter.com/reactjs/status/1024745321987887104","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6341","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mvjj-gqq2-p4hw","tags":["advisory"]},{"url":"https://snyk.io/vuln/npm:react-dom:20180802","tags":["web"]},{"url":"https://www.npmjs.com/advisories/1421","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-6341","description":"React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2.","status":"published","published":"2018-12-31T22:00:00Z","modified":"2025-05-06T16:54:17.932Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:05.961936Z"}],"euvd":[{"id":"EUVD-2019-0190","description":"React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2.","status":"published","published":"2018-12-31T22:00:00Z","modified":"2025-05-06T16:54:17Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:54.355989Z"}],"ghsa":[{"id":"GHSA-mvjj-gqq2-p4hw","title":"Cross-Site Scripting in react-dom","description":"Affected versions of `react-dom` are vulnerable to Cross-Site Scripting (XSS). The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by this vulnerability, the application needs to:\n- be a server-side React app\n- be rendered to HTML using `ReactDOMServer`\n- include an attribute name from user input in an HTML tag\n\n\n## Recommendation\n\nIf you are using `react-dom` 16.0.x, upgrade to 16.0.1 or later.  \nIf you are using `react-dom` 16.1.x, upgrade to 16.1.2 or later.  \nIf you are using `react-dom` 16.2.x, upgrade to 16.2.1 or later.  \nIf you are using `react-dom` 16.3.x, upgrade to 16.3.3 or later.  \nIf you are using `react-dom` 16.4.x, upgrade to 16.4.2 or later.","status":"published","published":"2019-01-04T19:05:35Z","modified":"2023-09-13T19:45:27Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:05.004935Z"}],"nvd":[{"id":"CVE-2018-6341","description":"React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2.","status":"published","published":"2018-12-31T22:29:00.387Z","modified":"2026-06-17T02:01:41.99Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:52.056758Z"}],"osv":[{"id":"CVE-2018-6341","description":"React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2.","status":"published","published":"2018-12-31T22:29:00.387Z","modified":"2026-10-24T10:30:37.522053751Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"GHSA-mvjj-gqq2-p4hw","title":"Cross-Site Scripting in react-dom","description":"Affected versions of `react-dom` are vulnerable to Cross-Site Scripting (XSS). The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by this vulnerability, the application needs to:\n- be a server-side React app\n- be rendered to HTML using `ReactDOMServer`\n- include an attribute name from user input in an HTML tag\n\n\n## Recommendation\n\nIf you are using `react-dom` 16.0.x, upgrade to 16.0.1 or later.  \nIf you are using `react-dom` 16.1.x, upgrade to 16.1.2 or later.  \nIf you are using `react-dom` 16.2.x, upgrade to 16.2.1 or later.  \nIf you are using `react-dom` 16.3.x, upgrade to 16.3.3 or later.  \nIf you are using `react-dom` 16.4.x, upgrade to 16.4.2 or later.","status":"published","published":"2019-01-04T19:05:35Z","modified":"2023-11-08T04:00:21.209483Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"CLSA-2026-1775521831","title":"TuxCare security update for 2 packages (1 CVE)","description":"TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 16.4.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:22Z","modified":"2026-10-18T07:15:07.11686814Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1792161467","title":"TuxCare security update for react-art (1 CVE)","description":"TuxCare rebuilt react-art to address 1 CVE. Fixed in 16.4.1-tuxcare.1.","status":"published","published":"2026-10-16T14:37:47Z","modified":"2026-10-16T16:31:03.08099948Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161489","title":"TuxCare security update for react-is (1 CVE)","description":"TuxCare rebuilt react-is to address 1 CVE. Fixed in 16.4.1-tuxcare.1.","status":"published","published":"2026-10-16T14:38:09Z","modified":"2026-10-16T16:31:03.986358932Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792267914","title":"TuxCare security update for react-dom (1 CVE)","description":"TuxCare rebuilt react-dom to address 1 CVE. Fixed in 16.4.1-tuxcare.1.","status":"published","published":"2026-10-17T20:11:54Z","modified":"2026-10-18T01:30:14.051029117Z","updated_at":"2026-11-02T15:43:52.288832Z"},{"id":"CLSA-2026-1792287259","title":"TuxCare security update for react-test-renderer (1 CVE)","description":"TuxCare rebuilt react-test-renderer to address 1 CVE. Fixed in 16.4.1-tuxcare.1.","status":"published","published":"2026-10-18T01:34:18Z","modified":"2026-10-18T07:15:06.099191089Z","updated_at":"2026-11-02T15:43:52.288832Z"}]}}