CVE-2026-113350 — react-admin before 5.15.5 Stored XSS via UrlField and FileField
react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by U…
Published: 2026-10-20 · CVSS: 5.1 · CVSS 4.0
react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type backend fields can execute JavaScript in an administrator's authenticated session when the administrator clicks the rendered link.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7