react-admin CVE-2026-113350

Exploitation requires that an attacker can store or influence the value of a URL-type backend field (e.g. a 'url' record attribute) that is rendered by react-admin's UrlField or FileField components in versions before 5.15.5 - this implies at least low-privilege authenticated write access to the data layer feeding the admin UI (PR:L). The payload is a javascript: URI (including obfuscated variants using mixed case, leading control characters, or embedded tabs/newlines, per the getSafeUrl regex in the patch). Execution additionally requires a victim administrator to passively interact by clicking the rendered link (UI:P). Limiting factors: it is not remote-unauthenticated (attacker needs write access), it depends on administrator click interaction, and it only affects deployments using UrlField/FileField on attacker-influenceable data in react-admin < 5.15.5; upgrading to 5.15.5 neutralizes it by rendering unsafe URLs as plain text.

This is a medium-severity stored XSS (CWE-79, CVSS 4.0 base 5.1) whose real-world urgency is moderate, not critical. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) shows that while the flaw is network-reachable and low-complexity, it is gated by two meaningful barriers: the attacker must already hold at least low-privilege write access to backend data (PR:L), and a victim administrator must passively interact by clicking the maliciously rendered link (UI:P). Impact is partial across confidentiality and integrity (VC:L/VI:L, VA:N) with a scope/subsequent-system effect (SC:L/SI:L) reflecting execution in the admin's authenticated session rather than full system compromise. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public POC was supplied - so there is no signal of active or widespread exploitation; exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. The signals are consistent (no conflict between vector and description), so the honest conclusion is a genuine-but-not-urgent issue: a vendor-confirmed, patched flaw whose exploitation depends on attacker write access plus admin interaction, making it a patch-on-normal-cycle item rather than an emergency.

A low-privileged user (or any actor able to influence a URL-type backend field) stores a 'javascript:alert(...)' payload in a record field that react-admin renders through UrlField or FileField. When an administrator later browses that record and clicks the rendered link, the script executes in the admin's authenticated session, enabling session-context actions such as token theft or admin-privileged requests. No public exploit code was provided in the input, though the patch diff and VulnCheck advisory describe the mechanism in detail.