4 ms·
The CVE says the that flaw is in React Server Components, which implies strongly that this is a RCE on the backend (!!), not the client.
by ajross 11mo ago
The CVE says the that flaw is in React Server Components, which implies strongly that this is a RCE on the backend (!!), not the client.
- padjo 11mo agoWhere else would it be? What would an RCE of the client even mean?
- cyptus 11mo agoit would be an RCE on your own machine :D
- deleted 11mo ago[deleted]
- ajross 11mo agoThe term is always ambiguous. But react is generally understood as a client library and client-side vulnerabilities are hardly a new thing. XSS exists as a whole subfield of study precisely because of the difficulty of keeping site code from getting fooled by malicious input. Basically you're technically correct with your quip, but engaging in some pretty awful security analysis. IMHO most people reading this headline are not going to understand that they need to audit their server dependencies.
- dfedbeef 11mo agoLCE
- IceDane 11mo agoBravo.
- heisenbit 11mo agoI suspect client developers are also affected at least to the extent that they need to explain this RCE to CVE driven management.