React patches a 10/10 flaw that can be used for remote code execution.