Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
React-Admin vulnerable to Cross-Site-Scripting attack on `<RichTextField>`
Vulnerability Description
react-admin is a frontend framework for building browser applications on top of REST/GraphQL APIs. react-admin prior to versions 3.19.12 and 4.7.6, along with ra-ui-materialui prior to 3.19.12 and 4.7.6, are vulnerable to cross-site scripting. All React applications built with react-admin and using the `<RichTextField>` are affected. `<RichTextField>` outputs the field value using `dangerouslySetInnerHTML` without client-side sanitization. If the data isn't sanitized server-side, this opens a possible cross-site scripting (XSS) attack. Versions 3.19.12 and 4.7.6 now use `DOMPurify` to escape the HTML before outputting it with React and `dangerouslySetInnerHTML`. Users who already sanitize HTML data server-side do not need to upgrade. As a workaround, users may replace the `<RichTextField>` by a custom field doing sanitization by hand.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Vulnerability Title
react-admin 跨站脚本漏洞
Vulnerability Description
react-admin是一个前端框架，用于构建在浏览器中运行在 REST/GraphQL API 之上的数据驱动应用程序，使用 ES6、React和Material Design。 react-admin 3.19.12之前的3.x版本和4.7.6之前之前的4.x版本存在安全漏洞，该漏洞源于存在跨站脚本漏洞。
CVSS Information
N/A
Vulnerability Type
N/A