Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time.
React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time.