CVE-2026-113350 in react-admin
Summary
by MITRE • 10/20/2026
react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type backend fields can execute JavaScript in an administrator's authenticated session when the administrator clicks the rendered link.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The identified security flaw resides within react-admin versions prior to 5.15.5, specifically affecting how certain field components handle and render data retrieved from backend sources. This vulnerability is classified as a stored cross-site scripting issue, which represents a severe category of web application insecurity where malicious scripts are permanently stored on the target server, typically in database fields or other persistent storage mechanisms. Unlike reflected XSS attacks that require immediate user interaction with a crafted link to trigger execution, this variant persists until an administrator views the compromised record, making it particularly dangerous for applications managing sensitive administrative data. The core technical flaw lies in the insufficient sanitization of URL-type inputs within the UrlField and FileField components. These components are designed to display hyperlinks or file references by taking raw string values from backend records and converting them into HTML anchor tags with href attributes. When an attacker successfully injects a javascript: URI scheme into these fields, the browser interprets this as valid protocol syntax rather than malicious code, thereby bypassing standard content security policies that might otherwise block inline script execution or non-HTTP protocols in certain contexts.
The operational impact of this vulnerability is significant for any organization relying on react-admin for administrative interfaces where user-generated content can influence URL fields. An attacker with the ability to submit data containing javascript: URIs, whether through direct input forms or by exploiting other injection points that feed into these specific fields, can achieve remote code execution within the context of an authenticated administrator's session. This means that once a privileged user navigates to a page displaying the compromised record and clicks on the rendered link, arbitrary JavaScript executes with the same permissions as the admin account. This capability allows for comprehensive session hijacking, where attackers can steal authentication tokens or cookies, perform actions on behalf of the victim such as modifying system configurations or exfiltrating sensitive data, and potentially pivot to further attacks within the internal network if the administrative interface provides access to other systems. The persistence of the payload ensures that every subsequent viewing by any authorized user poses a risk, amplifying the blast radius significantly compared to transient vulnerabilities.
From an industry standards perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. More specifically, it falls under CWE-80 due to the lack of proper validation on URL schemes before rendering them in HTML attributes. In terms of tactical mapping within the MITRE ATT&CK framework, this exploit leverages techniques associated with Client-side Injection and potentially Credential Access if session tokens are harvested. The attack vector relies heavily on social engineering or prior compromise to inject the payload, followed by a user interaction trigger which maps to T1059 Command and Scripting Interpreter via browser-based execution environments. Defenders must recognize that even fields intended for display purposes can become vectors for code execution if input validation is not strictly enforced at both the client-side rendering layer and the server-side ingestion layer.
Mitigation strategies require a multi-layered approach to address this deficiency effectively. The primary remediation involves upgrading react-admin to version 5.15.5 or later, where the maintainers have implemented stricter sanitization logic for UrlField and FileField components to reject or neutralize dangerous URI schemes like javascript:, data:, and vbscript:. For environments unable to upgrade immediately due to dependency constraints, a temporary workaround involves implementing custom input validation on the backend to strip or encode any occurrences of javascript: in URL-type fields before they are persisted. Additionally, deploying a robust Content Security Policy that restricts script execution sources can help mitigate the impact by preventing inline scripts from running even if injected into the DOM. It is also advisable to review all data entry points for these specific field types and ensure that input sanitization occurs at multiple layers of the application stack, including database constraints and API gateways, to prevent similar injection patterns in other parts of the system. Regular security audits focusing on how dynamic content is rendered in administrative interfaces are essential to identifying such latent risks before they can be exploited by malicious actors seeking unauthorized access or data manipulation capabilities.