Fluent UI

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical - deserialization of untrusted data or code injection, high-quality report │ $15,000 │ $16,000 Critical - authentication issues, improper access control, SSRF, or SQL and command injection │ $12,000 │ $13,000 Important - deserialization of untrusted data or code injection │ $10,000 │ $11,000 Critical - XSS, CSRF, cross-origin access, improper input validation, web misconfiguration │ $8,000 │ $9,000 Important - authentication issues, improper access control, SSRF, or SQL and command injection │ $6,000 │ $7,000 Critical - GitHub Actions in the repository │ $5,000 │ $6,000 Important - XSS, CSRF, cross-origin access, improper input validation, web misconfiguration │ $4,000 │ $5,000 Important - GitHub Actions in the repository │ $3,000 │ $3,750 Moderate and Low, every vulnerability type │ $0 │ $0 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime XSS 50 % Access control 20 % Info disclosure 20 % Injection 5 % Latest advisories Loading the feed Overview Fluent UI is Microsoft's official design system and the component layer behind Microsoft 365 web surfaces, Teams on web and desktop, the Microsoft admin centres, and a broad set of first-party and partner web applications. The 313,000 weekly npm downloads of @fluentui/react understate the real footprint badly, because the heavy consumers are internal Microsoft properties rendering authenticated enterprise tenant data rather than public installs. That is the whole argument for looking here: an injection primitive in a shared component is one defect that reaches every surface built on it at once, the classic design-system amplification pattern, and zero recorded CVEs across that surface reads as a research gap rather than a clean bill of health. Microsoft pays it through the MSRC Researcher Portal on the Open Source Bounty Program; the XSS row tops out at $8,000 for a high-quality Critical report, and only deserialization or code injection reaches the $15,000 headline. sorona.xyz adds 1.25x on top of whatever Microsoft awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The whole of microsoft/fluentui , which the program names on its SCOPE list as "FluentUI", at Critical or Important severity on the most recent actively maintained branch Every component in @fluentui/react and @fluentui/react-components : rendering, prop handling, and the sanitisation applied to anything a consumer passes in @fluentui/web-components and the shadow-DOM boundary it draws around each element The styling layer: theming, design tokens, and the CSS-in-JS engine that turns component input into injected style The primitives underneath the components, positioning, portals, focus management and keyboard navigation, which every surface inherits at once The published npm packages across the family, and the GitHub Actions workflows that build and release them, which the program prices in a band of their own Out of scope A consuming application's own misuse of the component APIs Microsoft repositories outside the program's fifteen-entry SCOPE list: the standard SECURITY.md pointing at MSRC is a reporting path and funds nothing React and the other third-party packages the library consumes rather than owns Findings whose impact stays on the local machine, since Fluent UI sits outside the carve-out Microsoft grants to VS Code, Agent Framework, TypeScript, Monaco Editor and PowerShell Moderate and Low severity, which pay $0 at every report quality Accessibility, layout and visual defects with no security impact The documentation site and Storybook demos Samples, tutorials and quickstart code Publicly disclosed issues and dependency-confusion reports Reports Microsoft cannot pay out on: residency in a sanctioned country, or no IRS tax form returned within 30 days of validation, voids the award Most-valued findings Code injection through theming or CSS-in-JS style construction, where component input escapes into executable context in the host application: the code-injection class carries the $15,000 top band and is the only route here above the $8,000 XSS ceiling Script execution out of the rich text, tooltip or callout rendering paths, home to the library's dangerouslySetInnerHTML -adjacent code, landing in the $8,000 Critical XSS band A javascript: or data: URL surviving a link or image prop and firing inside an authenticated Microsoft 365 tenant origin A shadow-DOM or web-components boundary break that lets injected markup reach the host document rather than staying inside the component Prop sanitisation that fails on a widely used component, since one such defect reaches every surface built on the design system simultaneously Compromise of the repository's release GitHub Actions, which would push tampered packages to every consumer and sits in the $5,000 Critical band Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. XSS, the dominant class here, is capped at $8,000 for a Critical high-quality report; the $15,000 band is reserved for deserialization of untrusted data and code injection Only Critical and Important severity qualify; Moderate and Low findings pay $0 under this program Reproduce on the most recent actively maintained branch, in the components themselves rather than in a consumer's misuse of them Fluent UI is not in the program's local-machine carve-out, so a finding needs impact beyond the reporter's own machine Follow coordinated vulnerability disclosure: Microsoft requires bounty submissions stay confidential while it fixes, and imposing a fix deadline forfeits eligibility Return an IRS tax form (W-9, W-8BEN or 8233) within 30 calendar days of validation, and expect sanctions screening Disclosure Coordinated through MSRC, which holds the detail until fixed packages are published and then issues its own advisory with researcher credit; expect the first-party Microsoft 365 surfaces to be patched before anything is said publicly. Microsoft requires bounty submissions stay confidential while it fixes, so file with MSRC yourself first and send sorona.xyz the case ID. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability