Stored Cross-Site Scripting Vulnerability in react-admin Product by Marmelab

CVE-2026-113350

What is CVE-2026-113350?

The react-admin product by Marmelab prior to version 5.15.5 is susceptible to a stored cross-site scripting vulnerability. This flaw permits attackers to inject malicious JavaScript into backend fields that are rendered as URL types, specifically through UrlField and FileField components. If an attacker manages to influence these URL-type fields, they can execute JavaScript in the context of an admin’s authenticated session when the rendered link is clicked. Users are advised to update to version 5.15.5 or later to mitigate this risk effectively.

References