{"id":"CVE-2023-25572","aliases":["GHSA-5jcr-82fh-339v"],"url":"https://o3.security/vulnerability/CVE-2023-25572","summary":"React-Admin vulnerable to Cross-Site-Scripting attack on `<RichTextField>`","details":"react-admin is a frontend framework for building browser applications on top of REST/GraphQL APIs. react-admin prior to versions 3.19.12 and 4.7.6, along with ra-ui-materialui prior to 3.19.12 and 4.7.6, are vulnerable to cross-site scripting. All React applications built with react-admin and using the `<RichTextField>` are affected. `<RichTextField>` outputs the field value using `dangerouslySetInnerHTML` without client-side sanitization. If the data isn't sanitized server-side, this opens a possible cross-site scripting (XSS) attack. Versions 3.19.12 and 4.7.6 now use `DOMPurify` to escape the HTML before outputting it with React and `dangerouslySetInnerHTML`. Users who already sanitize HTML data server-side do not need to upgrade. As a workaround, users may replace the `<RichTextField>` by a custom field doing sanitization by hand.\n","published":"2023-02-13T20:49:54.340Z","modified":"2026-08-12T03:51:10.334329131Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"epss":{"score":0.00694,"percentile":0.51313,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":2,"affectedPackages":[{"ecosystem":"npm","name":"react-admin","fixedVersion":"3.19.12"},{"ecosystem":"npm","name":"react-admin","fixedVersion":"4.7.6"},{"ecosystem":"npm","name":"ra-ui-materialui","fixedVersion":"4.7.6"},{"ecosystem":"npm","name":"ra-ui-materialui","fixedVersion":"3.19.12"}],"fix":{"url":"https://github.com/marmelab/react-admin/pull/8644","label":"marmelab/react-admin#8644"},"references":[{"type":"WEB","url":"https://github.com/marmelab/react-admin/releases/tag/v3.19.12"},{"type":"WEB","url":"https://github.com/marmelab/react-admin/releases/tag/v4.7.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25572.json"},{"type":"ADVISORY","url":"https://github.com/marmelab/react-admin/security/advisories/GHSA-5jcr-82fh-339v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25572"},{"type":"FIX","url":"https://github.com/marmelab/react-admin/pull/8644"},{"type":"FIX","url":"https://github.com/marmelab/react-admin/pull/8645"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:10.334329131Z"}}