AIKIDO-2025-10313
@react-awesome-query-builder/antd is vulnerable to Cross-site Scripting (XSS)
60
Medium Risk
This Affects:
@react-awesome-query-builder/antdTL;DR
Affected versions of this package are vulnerable to cross-site scripting (XSS) in the domUtils.calcTextWidth method. An attacker could exploit this by injecting malicious content that is interpreted as executable JavaScript when processed by the method, potentially leading to the execution of arbitrary scripts in the context of the user's session. This could result in unauthorized actions, data exposure, or session hijacking.
Who does this affect?
You are affected if you are using a version which is within vulnerability ranges
Background info
@react-awesome-query-builder/antd is vulnerable to Cross-site Scripting (XSS) in versions 6.3.0 - 6.6.14.
How to fix this
Upgrade the @react-awesome-query-builder/antd library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant