{"id":"CVE-2026-113350","title":"react-admin before 5.15.5 Stored XSS via UrlField and FileField","summary":"react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type …","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"marmelab","product":"react-admin","affected":["react-admin < 5.15.5"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-20T13:25:56.834629Z"},"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T13:26:16.586Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113350","references":[{"url":"https://github.com/marmelab/react-admin/issues/11408"},{"url":"https://github.com/marmelab/react-admin/commit/d20820a05dc8094d322ffa3f0bd9800501acb0a8"},{"url":"https://github.com/marmelab/react-admin/releases/tag/v5.15.5","label":"react-admin v5.15.5 Release Notes"},{"url":"https://github.com/marmelab/react-admin/blob/3119d7e56c178e699a2247b67868a4613039ffc3/packages/ra-ui-materialui/src/field/UrlField.tsx"},{"url":"https://www.vulncheck.com/advisories/react-admin-before-5.15.5-stored-xss-via-urlfield-and-filefield","label":"VulnCheck Advisory: react-admin before 5.15.5 Stored XSS via UrlField and FileField"}],"tags":["cve.org"],"ingestedAt":"2026-10-20T12:05:07.325Z","slug":"CVE-2026-113350","body":"## Overview\n\nreact-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type backend fields can execute JavaScript in an administrator's authenticated session when the administrator clicks the rendered link.\n\n## Affected\n\n- `react-admin < 5.15.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}