---
title: React. XSS Via A Spoofed React Element On Versions Under 0.14.0
description: "Impact Area Security       Severity low       Affected Element **ServiceNow** UI Script **Salesforce** Static Resource **Rule number** **SN-JSL-REACT-LESSTHAN-V0140 **(for ServiceNow) **SF-JSL-REACT-LESSTHAN-V0140 **(for Salesforce) ## Impact Including untrusted objects as React children can result in an XSS security vulnerability.…"
url: "https://community-staging.qualityclouds.com/qcdocs/qc/vulnerabilities-in-open-source-libraries-salesforce/react-xss-via-a-spoofed-react-element-on-versions-under-0-14-0/"
updated: "2025-03-21"
category: Rules
---

# React. XSS Via A Spoofed React Element On Versions Under 0.14.0

Impact Area

Security

 

 

 

           Severity

low

 

 

 

           Affected Element

**ServiceNow**

UI Script

**Salesforce**

Static Resource

**Rule number**

**SN-JSL-REACT-LESSTHAN-V0140 **(for ServiceNow)

**SF-JSL-REACT-LESSTHAN-V0140 **(for Salesforce)

## Impact

Including untrusted objects as React children can result in an XSS security vulnerability. This one took advantage of the way the arguments passed to React functions were being validated, tricking React into thinking it was rendering a React element instead of the string that was expected.

Remediation

Update the React JS library to the latest version.

**Time to fix**

30 min

## References

This rule is linked to [Common Weakness Enumeration CWE-79 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’).](https://cwe.mitre.org/data/definitions/79.html)