CVE-2021-23398: Cross-site Scripting (XSS)

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-06-24 · updated 2026-06-17
Weakness: CWE-79

Description

All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is returned, leading to dangerouslySetInnerHTML being used, which does not sanitize the output.

Affected products

react-bootstrap-table: all versions

References

https://github.com/AllenFang/react-bootstrap-table/blob/26d07defab759e4f9bce22d1d568690830b8d9d7/src/TableBody.js%23L114-L118
https://github.com/AllenFang/react-bootstrap-table/issues/2071
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314286
https://snyk.io/vuln/SNYK-JS-REACTBOOTSTRAPTABLE-1314285
https://github.com/AllenFang/react-bootstrap-table/blob/26d07defab759e4f9bce22d1d568690830b8d9d7/src/TableBody.js%23L114-L118
https://github.com/AllenFang/react-bootstrap-table/issues/2071
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314286
https://snyk.io/vuln/SNYK-JS-REACTBOOTSTRAPTABLE-1314285

Get alerted when CVE-2021-23398 or the next vulnerability affects your stack