Medium
5.4
react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows...
CVE-2026-113350
First seen on SecPulse
Original description The description as published by the source.
react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type backend fields can execute JavaScript in an administrator's authenticated session when the administrator clicks the rendered link.
Source: NIST National Vulnerability Database NVD GitHub Advisory