React vulnerability