marmelab CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM marmelab CVE published 2026-10-20

CVE-2026-113350

A stored cross-site scripting vulnerability exists in react-admin before version 5.15.5. An attacker can inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. This can lead to JavaScript execution in an administrator's authenticated session when the administrator clicks the rendered link. The vulnerability is triggered when an administrator accesses the affected r [truncated]