vetkit.js.xss.dangerously-set-inner-html

dangerouslySetInnerHTML / innerHTML receives a non-literal value. Unsanitised HTML leads to cross-site scripting.

Last updated: 2026-11-01

Suite: Security

javascript, typescript

dangerouslySetInnerHTML / innerHTML receives a non-literal value. Unsanitised HTML leads to cross-site scripting.

Category: SECURITY · Engine rule severity: WARNING

How to fix it

Render text instead of HTML, or sanitise with a vetted library (e.g. DOMPurify) right before rendering.

References

https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html

Source: packages/engine/rules/sast/javascript.yml.

Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.