Live › vulnerability › CVE-2026-113350
Go to dashboardreact-admin before 5.15.5 renders record fields through UrlField and FileField without blocking javascript: URIs, so a stored value can run script. An attacker who can write URL-type backend fields can run JavaScript in an administrator's logged-in session when that administrator clicks the link.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications built on react-admin versions before 5.15.5 that show UrlField or FileField on records a user can write, such as admin panels over user-submitted data. Apps that only show trusted, admin-controlled URLs or that do not use these two components are less exposed. The sources do not say whether a default configuration is vulnerable beyond that.
No product ranges from the sources yet.
npm ls react-admin5.15.5 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type backend fields can execute JavaScript in an administrator's authenticated session when the administrator clicks the rendered link.
This page as .md · .json · in your agent: get_signal("CVE-2026-113350")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.