The vulnerability is a stored cross‑site scripting flaw in react‑admin, where attacker‑supplied javascript: URIs can be stored in records and later rendered by UrlField and FileField components. This flaw, classified under CWE‑79, allows malicious scripts to run in the context of an authenticated administrator when the link is clicked, potentially leading to credential theft, session hijacking, or defacement.

Affected systems are installations of react‑admin from marmelab, specifically any version released before 5.15.5. The flaw exists in all builds that render UrlField or FileField components without filtering or escaping javascript: scheme links.

The CVSS score of 5.1 reflects moderate severity, with EPSS data unavailable and the vulnerability not listed in KEV. Attackers who can write values into URL‑type backend fields can store malicious javascript: URIs that will execute in an administrator's authenticated session on link click. Because the exploit relies on user interaction, the likelihood of exploitation is limited but still significant in environments where administrators view admin interfaces without strict content restrictions.