CVE-2021-23398: 
JavaScript vulnerability analysis and mitigation

All versions of the react-bootstrap-table package are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The vulnerability was discovered on April 18, 2019, and was assigned CVE-2021-23398. This security issue affects all versions of the package, with no fixed version available (CVE Details, Snyk Report).

The vulnerability is triggered when an invalid React element is returned, leading to dangerouslySetInnerHTML being used, which does not sanitize the output. The issue has a CVSS v3.1 base score of 6.1 (medium severity), with attack vector being Network, attack complexity Low, requiring no privileges, but user interaction is Required, and the scope is Changed (Snyk Report).

When exploited, this vulnerability can lead to cross-site scripting attacks, potentially allowing attackers to steal cookies, hijack user sessions, expose sensitive information, enable access to privileged services and functionality, and deliver malware. The vulnerability affects both confidentiality and integrity at a Low level, while there is no impact on availability (Snyk Report).

Currently, there is no fixed version available for the react-bootstrap-table package. As best practices, it is recommended to sanitize data input in HTTP requests before reflecting it back, ensure all data is validated, filtered or escaped, convert special characters to their HTML or URL encoded equivalents, and implement a Content Security Policy (Snyk Report).