CVE-2013-7035: Cross-Site Scripting in react
Summary
CVE-2013-7035: Cross-Site Scripting in react. Affects react across 2 version ranges.
>= 0.4.0, < 0.4.2
>= 0.5.0, < 0.5.2
Fixed in 0.4.2 or 0.5.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
React is a popular JavaScript library used for building user interfaces. It provides a declarative and efficient way to create interactive UI components. However, certain versions of the react package are vulnerable to Cross-Site Scripting (XSS) attacks. This vulnerability arises from the package's failure to properly sanitize user input used to create keys. As a result, if a key is generated from user input, attackers can execute arbitrary JavaScript code on the affected application.
Vulnerability Detail
The Cross-Site Scripting vulnerability in react allows attackers to inject malicious scripts into web pages viewed by users. This can lead to various security risks, including unauthorized access to sensitive information, session hijacking, and defacement of web pages. The vulnerability is rated as MODERATE severity with a CVSS score of 6.5. It affects versions 0.4.0 to 0.4.1 and 0.5.0 to 0.5.1 of the react package.
How To Fix
Latest published version: 19.3.1 as of 23 Oct 2026
npm install react@19.3.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.4.0, < 0.4.20.4.2npm install react@0.4.2 -
>= 0.5.0, < 0.5.20.5.2npm install react@0.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched versions of the react package to address the issue.
Conclusion
The Cross-Site Scripting vulnerability in the react package can have serious security implications for web applications. It is crucial to update to the patched versions (0.4.2 or later for 0.4.x, and 0.5.2 or later for 0.5.x) to mitigate the risk. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for react →
FAQ
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users. These scripts can be used to steal sensitive information, manipulate web content, or perform other malicious actions.
The react package becomes vulnerable to XSS when it fails to properly sanitize user input used to create keys. If a key is generated from user input without proper sanitization, it can contain malicious scripts that are executed when rendered in a web page.
The consequences of this vulnerability include unauthorized access to sensitive information, session hijacking, defacement of web pages, and potential compromise of user accounts.
No, only versions 0.4.0 to 0.4.1 and 0.5.0 to 0.5.1 of the react package are affected. It is recommended to upgrade to the patched versions (0.4.2 or later for 0.4.x, and 0.5.2 or later for 0.5.x) to mitigate the vulnerability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
References
Related vulnerabilities
Recent vulnerabilities recorded for react.
