CVE-2023-25572: 
JavaScript vulnerability analysis and mitigation

The vulnerability CVE-2023-25572 affects react-admin, a frontend framework for building browser applications on top of REST/GraphQL APIs. The vulnerability was discovered in versions prior to 3.19.12 and 4.7.6, and was disclosed on February 13, 2023. The issue specifically affects the RichTextField component, which outputs field values using dangerouslySetInnerHTML without proper client-side sanitization (GitHub Advisory).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue with a CVSS v3.1 score of 5.4 (Medium severity). The RichTextField component was found to be using dangerouslySetInnerHTML without implementing client-side sanitization, potentially allowing malicious HTML content to be executed if the data wasn't properly sanitized server-side. The vulnerability is tracked as CWE-79, which is a common classification for XSS issues (Snyk).

All React applications built with react-admin and using the RichTextField component are affected by this vulnerability. If the data isn't sanitized server-side, attackers could potentially execute malicious scripts through cross-site scripting attacks, potentially leading to data theft or session hijacking (GitHub Advisory).

The vulnerability has been patched in versions 3.19.12 and 4.7.6, which now use DOMPurify to escape HTML before outputting it with React and dangerouslySetInnerHTML. For users who cannot immediately upgrade, a workaround exists if HTML data is already being sanitized server-side. Alternatively, users can replace the RichTextField with a custom field implementing manual sanitization (GitHub Release, GitHub Release).