Unsanitised HTML rendered
Scan rule · RSC-SEC-062
- Security
- Severity: High
- CWE-79
- OWASP A03-2021
Finds `dangerouslySetInnerHTML` with a dynamic value — the classic XSS path.
Scan tier
- Source code from source maps
- Repo access (deep scan)
How to fix it
Sanitise the HTML before rendering, or render it as text.