---
id: CVE-2026-113350
title: react-admin before 5.15.5 Stored XSS via UrlField and FileField
summary: >-
  react-admin before 5.15.5 contains a stored cross-site scripting vulnerability
  that allows attackers to inject scripts by storing javascript: URIs in record
  fields rendered by UrlField and FileField. Attackers who can influence
  URL-type …
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: marmelab
product: react-admin
affected:
  - react-admin < 5.15.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-20T13:25:56.834629Z'
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T13:26:16.586Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113350'
references:
  - url: 'https://github.com/marmelab/react-admin/issues/11408'
  - url: >-
      https://github.com/marmelab/react-admin/commit/d20820a05dc8094d322ffa3f0bd9800501acb0a8
  - url: 'https://github.com/marmelab/react-admin/releases/tag/v5.15.5'
    label: react-admin v5.15.5 Release Notes
  - url: >-
      https://github.com/marmelab/react-admin/blob/3119d7e56c178e699a2247b67868a4613039ffc3/packages/ra-ui-materialui/src/field/UrlField.tsx
  - url: >-
      https://www.vulncheck.com/advisories/react-admin-before-5.15.5-stored-xss-via-urlfield-and-filefield
    label: >-
      VulnCheck Advisory: react-admin before 5.15.5 Stored XSS via UrlField and
      FileField
tags:
  - cve.org
ingestedAt: '2026-10-20T12:05:07.325Z'
---

## Overview

react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type backend fields can execute JavaScript in an administrator's authenticated session when the administrator clicks the rendered link.

## Affected

- `react-admin < 5.15.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.