CVE-2026-113350 marmelab CVE debrief

Who should care

Defenders responsible for react-admin deployments, administrators with access to vulnerable versions, and security teams monitoring for potential XSS attacks should be aware of this vulnerability.

Why it matters

This stored XSS vulnerability in react-admin before version 5.15.5 allows attackers to inject scripts, potentially leading to unauthorized actions in administrator sessions. Defenders should prioritize updating to version 5.15.5 or later and monitor for suspicious activity.

• JavaScript execution in administrator sessions
• Potential for unauthorized actions
• Need for version updates or patches
• Monitoring for suspicious activity

Technical summary

The vulnerability allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField in react-admin before version 5.15.5. This is possible because the library does not properly sanitize user-input data, allowing an attacker to inject malicious JavaScript code. When an administrator clicks on the rendered link, the injected script is executed within the context of the administrator's authenticated session, potentially leading to unauthorized actions within the react-admin application.

Defensive priority

Defenders should prioritize updating to version 5.15.5 or later to mitigate this vulnerability.

Recommended defensive actions

• Update to version 5.15.5 or later
• Review and monitor UrlField and FileField usage
• Implement additional security measures for administrator sessions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. The vulnerability was reported and verified through the CVE Program and NVD. The affected product, react-admin, is a popular open-source library for building administrative interfaces in React. The vulnerability affects versions prior to 5.15.5, and defenders should verify their deployments to ensure they are running a patched version.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.