React
Monthly
Refine's @refinedev/inferencer package through version 7.0.0 interpolates API field names straight into generated JSX source without escaping, so an attacker who controls or has compromised the data provider can supply crafted JSON property names that execute as JavaScript in a developer's browser when an Inferencer-generated page renders. Remote, unauthenticated input is possible per the published vector (PR:N), but exploitation is gated on developer interaction (UI:P/UI:R), a malicious or untrusted backend (AC:H/AT:P), and a developer actually previewing Inferencer output - hence our independent assessment rates real-world risk materially below the 7.7 CVSS 4.0 headline, and no public exploit code was identified at time of analysis. The issue is tracked upstream in the refinedev/refine repository as issue #7556.
Uncontrolled resource consumption in React Server Components (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack) allows unauthenticated remote attackers to trigger denial of service through malformed requests to Server Function endpoints, causing server crashes, memory exhaustion, or CPU spikes. Applications using these packages are at risk of availability disruption. No patch is currently available; immediate mitigation and monitoring are recommended.
React Server Components in React 19.x contain a critical pre-authentication remote code execution vulnerability (CVE-2025-55182, CVSS 10.0) through unsafe deserialization of HTTP request payloads. With EPSS 71.1% and KEV listing, this vulnerability affects any application using React Server Components with react-server-dom-webpack, react-server-dom-turbopack, or react-server-dom-parcel — enabling complete server compromise through a single HTTP request.
Cross-site scripting in udecode Plate's core HTML deserialization APIs allows attacker-controlled script to execute in a consuming application's origin when untrusted or cross-user HTML is deserialized and then loaded by another user; affected builds are all versions prior to 53.3.11 plus the discontinued 54.0.0-beta.0 and 54.0.0-beta.1 prereleases. The pre-fix code parsed supplied HTML strings in the active document, so certain attributes triggered browser behavior before the markup was converted into editor nodes; the assessed vector (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects network-delivered input needing no authentication (PR:N) but requiring victim interaction (UI:R) and a scope change, and exploitation is only realistic where the consuming application itself wires attacker-influenced HTML into these APIs. There is no public exploit identified at time of analysis and no KEV listing, but the vendor has shipped a fix in 53.3.11.
OS command injection in create-react-app's react-dev-utils component enables remote code execution on macOS developer workstations running version 5.0.1 or earlier. The vulnerability resides in the startBrowserProcess function of openBrowser.js, which processes unsanitized input that reaches a shell invocation. A publicly available proof-of-concept exploit exists via the project's GitHub issue tracker; no vendor patch has been released and the maintainers have not responded to disclosure, leaving the entire supported version history of this widely-used but now-archived tool permanently unpatched.
Wekan is an open source kanban tool built with Meteor. [CVSS 6.5 MEDIUM]
Openclaw versions up to 2026.2.12 is affected by missing authentication for critical function (CVSS 5.9).
Teamcity versions up to 2025.11.3 is affected by url redirection to untrusted site (open redirect) (CVSS 4.3).
Reflected XSS in Repostat's RepoCard React component prior to version 1.0.1 allows attackers to execute arbitrary JavaScript in users' browsers when developers pass unsanitized input from URL parameters or other sources to the repo prop. The vulnerability stems from unsafe use of dangerouslySetInnerHTML without input validation, and public exploit code exists. Upgrading to version 1.0.1 or later eliminates the risk by removing dangerouslySetInnerHTML in favor of safe JSX data binding.
Simple Membership (WordPress plugin) versions up to 4.7.0 contains a security vulnerability (CVSS 6.5).
A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. [CVSS 4.3 MEDIUM]
React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. [CVSS 6.5 MEDIUM]
React-Router versions up to 6.30.1 is affected by url redirection to untrusted site (open redirect) (CVSS 6.5).
HTML injection in Preact and React through unsafe JSON deserialization allows remote attackers to inject arbitrary scripts when applications pass unsanitized user-controlled data as component children, with public exploit code already available. The vulnerability stems from a regression in Preact 10.26.5 that weakened protections against constructing Virtual DOM elements from malicious JSON payloads. Affected applications are vulnerable if they consume unvalidated external data without sanitization and lack additional mitigations like Content Security Policy.
Unsafe deserialization in React Server Components Server Function endpoints allows remote unauthenticated attackers to trigger an infinite loop that hangs the server process and can prevent subsequent HTTP requests from being served. The flaw affects React 19.0.2, 19.1.3, and 19.2.2 - including Next.js applications on Node.js that expose Server Functions (Server Actions) - and it represents an incomplete fix for CVE-2025-55184. EPSS is 19.99% (97th percentile), and no public exploit identified at time of analysis; CISA KEV does not list it as confirmed actively exploited.
Pre-authentication denial of service in React Server Components (versions 19.0.0 through 19.2.1) allows unauthenticated remote attackers to hang the server process by sending specially crafted payloads to Server Function endpoints, causing an infinite loop that prevents further HTTP requests from being served. This affects applications using the react-server-dom-parcel, react-server-dom-turbopack, or react-server-dom-webpack packages, commonly seen in Next.js App Router deployments. Publicly available exploit code exists (e.g., GitHub repository referenced), and the EPSS score is 66.88% (99th percentile), indicating a high likelihood of exploitation; however, there is no confirmation of active exploitation in CISA KEV.
Information disclosure in React Server Components 19.x, distributed as react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel, lets remote unauthenticated attackers retrieve the source code of a Server Function with a single crafted HTTP request and no user interaction. The flaw is not universal: it requires the application to define a Server Function that explicitly or implicitly exposes a stringified argument, and its impact is limited to source-code disclosure, with no code execution, data modification or availability effect (CVSS 5.3, C:L with I:N/A:N). Exploitation priority is driven by the intelligence picture rather than the score itself - publicly available exploit code exists and EPSS stands at 64.23% (99th percentile) - while there is no confirmed active exploitation (CISA KEV) at time of analysis.
react-native-keys version 0.7.11 contains a sensitive information disclosure vulnerability where encryption ciphers and Base64-encoded secrets are stored as plaintext in compiled native binaries, allowing attackers with network access to extract these credentials via static analysis of the binary. This affects all applications using the vulnerable library version, and the high CVSS score of 7.5 reflects the ease of exploitation (no authentication required) and significant confidentiality impact, though the practical risk depends on whether secrets are actually embedded at build time and the sensitivity of exposed data.
React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Refine's @refinedev/inferencer package through version 7.0.0 interpolates API field names straight into generated JSX source without escaping, so an attacker who controls or has compromised the data provider can supply crafted JSON property names that execute as JavaScript in a developer's browser when an Inferencer-generated page renders. Remote, unauthenticated input is possible per the published vector (PR:N), but exploitation is gated on developer interaction (UI:P/UI:R), a malicious or untrusted backend (AC:H/AT:P), and a developer actually previewing Inferencer output - hence our independent assessment rates real-world risk materially below the 7.7 CVSS 4.0 headline, and no public exploit code was identified at time of analysis. The issue is tracked upstream in the refinedev/refine repository as issue #7556.
Uncontrolled resource consumption in React Server Components (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack) allows unauthenticated remote attackers to trigger denial of service through malformed requests to Server Function endpoints, causing server crashes, memory exhaustion, or CPU spikes. Applications using these packages are at risk of availability disruption. No patch is currently available; immediate mitigation and monitoring are recommended.
React Server Components in React 19.x contain a critical pre-authentication remote code execution vulnerability (CVE-2025-55182, CVSS 10.0) through unsafe deserialization of HTTP request payloads. With EPSS 71.1% and KEV listing, this vulnerability affects any application using React Server Components with react-server-dom-webpack, react-server-dom-turbopack, or react-server-dom-parcel — enabling complete server compromise through a single HTTP request.
Cross-site scripting in udecode Plate's core HTML deserialization APIs allows attacker-controlled script to execute in a consuming application's origin when untrusted or cross-user HTML is deserialized and then loaded by another user; affected builds are all versions prior to 53.3.11 plus the discontinued 54.0.0-beta.0 and 54.0.0-beta.1 prereleases. The pre-fix code parsed supplied HTML strings in the active document, so certain attributes triggered browser behavior before the markup was converted into editor nodes; the assessed vector (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects network-delivered input needing no authentication (PR:N) but requiring victim interaction (UI:R) and a scope change, and exploitation is only realistic where the consuming application itself wires attacker-influenced HTML into these APIs. There is no public exploit identified at time of analysis and no KEV listing, but the vendor has shipped a fix in 53.3.11.
OS command injection in create-react-app's react-dev-utils component enables remote code execution on macOS developer workstations running version 5.0.1 or earlier. The vulnerability resides in the startBrowserProcess function of openBrowser.js, which processes unsanitized input that reaches a shell invocation. A publicly available proof-of-concept exploit exists via the project's GitHub issue tracker; no vendor patch has been released and the maintainers have not responded to disclosure, leaving the entire supported version history of this widely-used but now-archived tool permanently unpatched.
Wekan is an open source kanban tool built with Meteor. [CVSS 6.5 MEDIUM]
Openclaw versions up to 2026.2.12 is affected by missing authentication for critical function (CVSS 5.9).
Teamcity versions up to 2025.11.3 is affected by url redirection to untrusted site (open redirect) (CVSS 4.3).
Reflected XSS in Repostat's RepoCard React component prior to version 1.0.1 allows attackers to execute arbitrary JavaScript in users' browsers when developers pass unsanitized input from URL parameters or other sources to the repo prop. The vulnerability stems from unsafe use of dangerouslySetInnerHTML without input validation, and public exploit code exists. Upgrading to version 1.0.1 or later eliminates the risk by removing dangerouslySetInnerHTML in favor of safe JSX data binding.
Simple Membership (WordPress plugin) versions up to 4.7.0 contains a security vulnerability (CVSS 6.5).
A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connection. [CVSS 4.3 MEDIUM]
React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. [CVSS 6.5 MEDIUM]
React-Router versions up to 6.30.1 is affected by url redirection to untrusted site (open redirect) (CVSS 6.5).
HTML injection in Preact and React through unsafe JSON deserialization allows remote attackers to inject arbitrary scripts when applications pass unsanitized user-controlled data as component children, with public exploit code already available. The vulnerability stems from a regression in Preact 10.26.5 that weakened protections against constructing Virtual DOM elements from malicious JSON payloads. Affected applications are vulnerable if they consume unvalidated external data without sanitization and lack additional mitigations like Content Security Policy.
Unsafe deserialization in React Server Components Server Function endpoints allows remote unauthenticated attackers to trigger an infinite loop that hangs the server process and can prevent subsequent HTTP requests from being served. The flaw affects React 19.0.2, 19.1.3, and 19.2.2 - including Next.js applications on Node.js that expose Server Functions (Server Actions) - and it represents an incomplete fix for CVE-2025-55184. EPSS is 19.99% (97th percentile), and no public exploit identified at time of analysis; CISA KEV does not list it as confirmed actively exploited.
Pre-authentication denial of service in React Server Components (versions 19.0.0 through 19.2.1) allows unauthenticated remote attackers to hang the server process by sending specially crafted payloads to Server Function endpoints, causing an infinite loop that prevents further HTTP requests from being served. This affects applications using the react-server-dom-parcel, react-server-dom-turbopack, or react-server-dom-webpack packages, commonly seen in Next.js App Router deployments. Publicly available exploit code exists (e.g., GitHub repository referenced), and the EPSS score is 66.88% (99th percentile), indicating a high likelihood of exploitation; however, there is no confirmation of active exploitation in CISA KEV.
Information disclosure in React Server Components 19.x, distributed as react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel, lets remote unauthenticated attackers retrieve the source code of a Server Function with a single crafted HTTP request and no user interaction. The flaw is not universal: it requires the application to define a Server Function that explicitly or implicitly exposes a stringified argument, and its impact is limited to source-code disclosure, with no code execution, data modification or availability effect (CVSS 5.3, C:L with I:N/A:N). Exploitation priority is driven by the intelligence picture rather than the score itself - publicly available exploit code exists and EPSS stands at 64.23% (99th percentile) - while there is no confirmed active exploitation (CISA KEV) at time of analysis.
react-native-keys version 0.7.11 contains a sensitive information disclosure vulnerability where encryption ciphers and Base64-encoded secrets are stored as plaintext in compiled native binaries, allowing attackers with network access to extract these credentials via static analysis of the binary. This affects all applications using the vulnerable library version, and the high CVSS score of 7.5 reflects the ease of exploitation (no authentication required) and significant confidentiality impact, though the practical risk depends on whether secrets are actually embedded at build time and the sensitivity of exposed data.
React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.