react-admin vulnerabilities

CVEs whose affected-version data names the react-admin package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-113350Medium· 5.4

today

react-admin before 5.15.5 Stored XSS via UrlField and FileField

react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type …

▾ Sunlitmarmelab · react-adminvia CVEORG