A arstechnica.com React executes malicious code with malformed HTML–no authentication needed 3 points gbourne 11 months ago 2 comments