React vulnerabilities
We track 2 vulnerabilities in React products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 10, 2026.
2vulnerabilities
1critical
1high
0exploited
8.4average CVSS score
Latest React vulnerabilities
- 9.5 Critical severity
react: Deserialization of Untrusted Data
React is a JavaScript library for building user interfaces. From 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1, the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages are vulnerable to unauthenticated remote code exec
- 7.3 High severity
create-react-app: Improper Neutralization of Special Elements used in a Command
A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProcess of the file openBrowser.js of the component react-dev-utils. Performing a manipulation results in os command injection. Remote exploitati