CVE-2018-6341: Cross-Site Scripting in react-dom

react-dom Updated 02 Oct 2025

Summary

04/01/2019

Disclosed on

CVE-2018-6341

CVE

Yes i

Fix available

Moderate

Severity

6.1

CVSS Score

CVE-2018-6341: Cross-Site Scripting in react-dom. Affects react-dom across 5 version ranges.

>= 16.0.0, < 16.0.1 >= 16.1.0, < 16.1.2 >= 16.2.0, < 16.2.1 >= 16.3.0, < 16.3.3 >= 16.4.0, < 16.4.2

Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

React-DOM is a package in the npm ecosystem that provides the rendering capabilities for React applications on the server-side. It allows developers to render React components to HTML using ReactDOMServer. This package is widely used in server-side React applications. However, certain versions of react-dom are vulnerable to Cross-Site Scripting (XSS) attacks.

Vulnerability Detail

The vulnerability in react-dom arises from the package's failure to validate attribute names in HTML tags. This can lead to Cross-Site Scripting in specific scenarios, enabling attackers to execute arbitrary JavaScript code in the victim's browser. To be affected by this vulnerability, the application needs to be a server-side React app, rendered to HTML using ReactDOMServer, and include an attribute name from user input in an HTML tag.

How To Fix

Fixed versions by release line

The minimum fixed version depends on the release line you run.

>= 16.0.0, < 16.0.1 16.0.1
```
npm install react-dom@16.0.1
```
>= 16.1.0, < 16.1.2 16.1.2
```
npm install react-dom@16.1.2
```
>= 16.2.0, < 16.2.1 16.2.1
```
npm install react-dom@16.2.1
```
>= 16.3.0, < 16.3.3 16.3.3
```
npm install react-dom@16.3.3
```
>= 16.4.0, < 16.4.2 16.4.2
```
npm install react-dom@16.4.2
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

There is no specific workaround mentioned for this vulnerability.

Conclusion

In conclusion, react-dom versions prior to the recommended versions are vulnerable to Cross-Site Scripting (XSS) attacks. It is crucial to upgrade to the fixed versions to ensure the security of server-side React applications. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for react-dom →