chore(deps): update dependency react-dom to v16.3.3 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
react-dom (source)	16.3.2 → 16.3.3

---

Cross-Site Scripting in react-dom

CVE-2018-6341 / GHSA-mvjj-gqq2-p4hw

More information

Details

Affected versions of react-dom are vulnerable to Cross-Site Scripting (XSS). The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by this vulnerability, the application needs to:

• be a server-side React app
• be rendered to HTML using ReactDOMServer
• include an attribute name from user input in an HTML tag

Recommendation

If you are using react-dom 16.0.x, upgrade to 16.0.1 or later.
If you are using react-dom 16.1.x, upgrade to 16.1.2 or later.
If you are using react-dom 16.2.x, upgrade to 16.2.1 or later.
If you are using react-dom 16.3.x, upgrade to 16.3.3 or later.
If you are using react-dom 16.4.x, upgrade to 16.4.2 or later.

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2018-6341
• https://github.com/advisories/GHSA-mvjj-gqq2-p4hw
• https://reactjs.org/blog/2018/08/01/react-v-16-4-2.html
• https://snyk.io/vuln/npm:react-dom:20180802
• https://www.npmjs.com/advisories/1421
• https://twitter.com/reactjs/status/1024745321987887104

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

facebook/react (react-dom)

v16.3.3

React DOM Server

• Fix a potential XSS vulnerability when the attacker controls an attribute name (CVE-2018-6341). This fix is available in the latest react-dom@16.4.2, as well as in previous affected minor versions: react-dom@16.0.1, react-dom@16.1.2, react-dom@16.2.1, and react-dom@16.3.3. (@​gaearon in #​13302)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.