CVE-2021-23398

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is returned, leading to dangerouslySetInnerHTML being used, which does not sanitize the output.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	react-bootstrap-table	< unspecified

References

https://github.com/AllenFang/react-bootstrap-table/blob/26d07defab759e4f9bce22d1d568690830b8d9d7/src/TableBody.js%23L114-L118Broken Link
https://github.com/AllenFang/react-bootstrap-table/issues/2071Exploit, Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314286Exploit, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-REACTBOOTSTRAPTABLE-1314285Exploit, Third Party Advisory
https://github.com/AllenFang/react-bootstrap-table/blob/26d07defab759e4f9bce22d1d568690830b8d9d7/src/TableBody.js%23L114-L118Broken Link
https://github.com/AllenFang/react-bootstrap-table/issues/2071Exploit, Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314286Exploit, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-REACTBOOTSTRAPTABLE-1314285Exploit, Third Party Advisory

Timeline

Published: Jun 24, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-233999.8This affects all versions of package wincred. If attacker-controlled user input is given to the getCredential function, it is possible for a CVE-2021-23402.7Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Memcached). Supported versions that are affected are 8.0.25 an CVE-2021-234008.8The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage CVE-2021-234016.1This affects all versions of package Flask-User. When using the make_safe_url function, it is possible to bypass URL validation and redirect CVE-2021-234029.8All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality.CVE-2021-234039.8All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.CVE-2021-234048.8This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the CVE-2021-234058.8This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method CVE-2021-234069.8This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:*CVE-2021-234077.5This affects the package elFinder.Net.Core from 0 and before 1.2.4. The user-controlled file name is not properly sanitized before it is use CVE-2021-234084.3This affects the package com.graphhopper:graphhopper-web-bundle before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked in CVE-2021-234097.5The package github.com/pires/go-proxyproto before 0.6.0 are vulnerable to Denial of Service (DoS) via creating connections without the proxy