CVE-2023-51843 concerns Flatlogic react-dashboard 1.4.0, a template that stores its login token without the httpOnly flag. The record rates it High at 8.2 as cross site scripting. No fixed version is named, so move the token to an httpOnly cookie in your own app.
What's affected
react-dashboard 1.4.0 from Flatlogic. The record does not name a fixed version. The project's issue 65 is titled JWT Should be Stored in an HttpOnly Cookie.
This is a template that teams copy into their own apps, so the exposure is in every app built from it that kept the pattern.
The record gives a CVSS score of 8.2 (High). The CVSS vector reads as follows. The attack can be reached over the network, and the complexity is low. No account is needed. A user has to take some action, such as opening a file or following a link. Impact on confidentiality is high, on integrity low, and on availability none. The weakness class is CWE-79.
How to check if you're exposed
Open your project's package.json and read the version, for example with grep version package.json. Then search your code for where the login token is stored. If it is in localStorage or in a cookie without the httpOnly flag, scripts running on the page can read it.
In a browser, open developer tools, look at Cookies, and check the HttpOnly column.
What to do now
- Find apps built from react-dashboard and check how they store tokens.
- Move session tokens to cookies set by the server with HttpOnly, Secure and a suitable SameSite value.
- Add a strict content security policy to limit script sources.
- Review the app for places where user input reaches the page unescaped.
- Check the project's issue 65 for upstream changes.
Why it matters
Without httpOnly, any script on the page can read the cookie. That turns any cross site scripting bug, even a small one, into token theft. The record classifies the weakness as CWE-79.
The score is High, with a user having to take an action and a scope change, because stolen tokens work from anywhere. It is a defense in depth gap: the flag does not cause scripting bugs, but its absence magnifies them.
Templates spread their defaults. A single insecure choice can appear in many production apps.
Try it yourself
See how a pull request gate can stop risky changes from reaching your main branch.
Click through it at your own pace, or open it full screen.
Quick check
Does the missing flag create the XSS?
It does not create the injection, but it lets scripts read the token.
Is there a patched version?
None is named. Fix the token storage in your own code.
Sources
Last reviewed: 19 October 2026.
