CVE-2018-6341

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
Facebookreact-dom16.4.2; >= 16.4.0, < unspecified; 16.3.3; >= 16.3.0, < unspecified; 16.2.1; >= 16.2.0, < unspecified; 16.1.2; >= 16.1.0, < unspecified; 16.0.1; >= 16.0.0, < unspecified

References

Timeline

Published
Dec 31, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-63429.8react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editoCVE-2018-63437.5Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsiCVE-2018-63447.5A heap corruption in WhatsApp can be caused by a malformed RTP packet being sent after a call is established. The vulnerability can be used CVE-2018-63459.8The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively large. The internal CVE-2018-63467.5A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings (specifically a circular dependency). This aCVE-2018-63477.5An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack. This affects Proxygen prior tCVE-2018-63499.8When receiving calls using WhatsApp for Android, a missing size check when parsing a sender-provided packet allowed for a stack-based overflCVE-2018-63509.8An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers. This issue affects WhatsApp for Android prCVE-2018-63525.5In PoDoFo 0.9.5, there is an Excessive Iteration in the PdfParser::ReadObjectsInternal function of base/PdfParser.cpp. Remote attackers coulCVE-2018-63537.8The Python console in Electrum through 2.9.4 and 3.x through 3.0.5 supports arbitrary Python code without considering (1) social-engineeringCVE-2018-63546.1templates/forms/thanks.html in Formspree before 2018-01-23 allows XSS related to the _next parameter.CVE-2018-63556.1/goform/setLang on iBall 300M devices with "iB-WRB302N_1.0.1-Sep 8 2017" firmware has Unauthenticated Stored Cross Site Scripting via the la