React with Caution: How to Hack Your React App (And Fix It Too)

React has your back, at least on paper. With almost no CVEs in recent years, React Core stands out as one of the most secure frontend frameworks available. But security isn’t automatic.

In this practical, hands-on session, Ramona will actively hack a React application to expose real-world threats like XSS, injection attacks, and subtle frontend vulnerabilities. You’ll learn where React protects you by default, where it doesn’t, and how to become the final line of defense for your users.

Transcript

1. @leichteckig React with Caution! How to hack your app (and fix it too)
2. @leichteckig React with Caution
3. @leichteckig React with Caution
4. @leichteckig React with Caution Your app is a concert venue
5. @leichteckig React with Caution
6. @leichteckig React with Caution
7. @leichteckig React with Caution The Foundation..
8. @leichteckig React with Caution
9. @leichteckig React with Caution
10. @leichteckig React with Caution
11. @leichteckig React with Caution Taint APIs Automatic XSS Protection (JSX) “server-only”
12. @leichteckig React with Caution
13. @leichteckig React with Caution The delivery is sus. CVE-2026-45321: TANStack
14. @leichteckig React with Caution The Supply Chain.
15. @leichteckig React with Caution ommon urnerabilities (&) xposures The Supply Chain.
16. @leichteckig React with Caution ommon urnerabilities (&) xposures NPM issues The Supply Chain.
17. @leichteckig React with Caution ommon urnerabilities (&) xposures NPM issues Axios CVE-2026-40175 The Supply Chain.
18. @leichteckig React with Caution ommon urnerabilities (&) xposures NPM issues Axios CVE-2026-40175 ua-parser-js CVE-2021-27458 The Supply Chain.
19. @leichteckig React with Caution ommon urnerabilities (&) xposures NPM issues AI stuff Axios CVE-2026-40175 ua-parser-js CVE-2021-27458 The Supply Chain.
20. @leichteckig React with Caution ommon urnerabilities (&) xposures NPM issues AI stuff ReDOS Axios CVE-2026-40175 ua-parser-js CVE-2021-27458 The Supply Chain.
21. @leichteckig React with Caution ommon urnerabilities (&) xposures NPM issues AI stuff ReDOS Axios CVE-2026-40175 ua-parser-js CVE-2021-27458 react-refresh Typo-Squatting Attack The Supply Chain.
22. @leichteckig React with Caution Check your dependencies! Only trusted packages Vet your AI code Utilize lockfiles Use behavioral scanners +npm audit
23. @leichteckig React with Caution Example: Instagram 2019
24. @leichteckig React with Caution Example: Instagram 2019
25. @leichteckig React with Caution Example: Instagram 2019
26. @leichteckig React with Caution The Bouncer = Access Control
27. @leichteckig React with Caution
28. @leichteckig React with Caution
29. @leichteckig React with Caution There’s more options…
30. @leichteckig React with Caution They‘re the same picture. JSX Full protection …are they?
31. @leichteckig React with Caution They‘re the same picture. JSX Full protection …are they?
32. @leichteckig CVE-2023-25572: react-admin
33. @leichteckig React with Caution The Courtyard.
34. @leichteckig React with Caution
35. @leichteckig React with Caution
36. @leichteckig React with Caution
37. @leichteckig React with Caution
38. @leichteckig React with Caution CVE-2025-5267 Credit cards in Firefox
39. @leichteckig
40. @leichteckig React with Caution
41. @leichteckig React with Caution
42. @leichteckig React with Caution
43. @leichteckig React with Caution The Allies.
44. @leichteckig React with Caution The Allies. OWASP
45. @leichteckig React with Caution
46. @leichteckig React with Caution Audit supply chain Validate route parameters Lock down with CSP Sanitize raw HTML Mind OWASP Vet AI (agent’s) code
47. @leichteckig