CVE-2021-23398

All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is returned, leading to dangerouslySetInnerHTML being used, which does not sanitize the output.

• CWE-79

• https://github.com/AllenFang/react-bootstrap-table/blob/26d07defab759e4f9bce22d1d568690830b8d9d7/src/TableBody.js%23L114-L118Broken Link
• https://github.com/AllenFang/react-bootstrap-table/issues/2071Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314286Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-REACTBOOTSTRAPTABLE-1314285Exploit, Third Party Advisory
• https://github.com/AllenFang/react-bootstrap-table/blob/26d07defab759e4f9bce22d1d568690830b8d9d7/src/TableBody.js%23L114-L118Broken Link
• https://github.com/AllenFang/react-bootstrap-table/issues/2071Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314286Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-REACTBOOTSTRAPTABLE-1314285Exploit, Third Party Advisory

Published

Jun 24, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23392The package locutus before 2.0.15 are vulnerable to Regular …7.5
• CVE-2021-23393This affects the package Flask-Unchained before 0.9.0. When …5.4
• CVE-2021-23394The package studio-42/elfinder before 2.1.58 are vulnerable …9.8
• CVE-2021-23395This affects all versions of package nedb. The library could…5.3
• CVE-2021-23396All versions of package lutils are vulnerable to Prototype P…9.8
• CVE-2021-23397All versions of package @ianwalter/merge are vulnerable to P…9.8
• CVE-2021-23399This affects all versions of package wincred. If attacker-co…9.8
• CVE-2021-2340Vulnerability in the MySQL Server product of Oracle MySQL (c…2.7
• CVE-2021-23400The package nodemailer before 6.6.1 are vulnerable to HTTP H…8.8
• CVE-2021-23401This affects all versions of package Flask-User. When using …6.1
• CVE-2021-23402All versions of package record-like-deep-assign are vulnerab…9.8
• CVE-2021-23403All versions of package ts-nodash are vulnerable to Prototyp…9.8