CVE-2018-6341

score

<0.1

cvss

6.1

epss

3.4%

published

2018-12-31

kev added

—

first seen

2026-10-21

React < 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2 contain a cross-site scripting caused by unescaped user-supplied attribute names during server-side rendering with ReactDOMServer, letting attackers execute scripts in the context of the application, exploit requires attacker to supply malicious attribute names.