JavaScript innerHTML and document.write XSS
Rule ID: vetkit.js.xss.inner-html
innerHTML / outerHTML / insertAdjacentHTML / document.write receives a non-literal value. Unsanitised HTML leads to cross-site scripting.
Last updated:
Suite: Security
javascript, typescript
innerHTML / outerHTML / insertAdjacentHTML / document.write receives a non-literal value. Unsanitised HTML leads to cross-site scripting.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Assign textContent instead of HTML, or sanitise with a vetted library (e.g. DOMPurify) right before inserting.
References
Source: packages/engine/rules/sast/javascript.yml.
Related checks
- Angular bypassSecurityTrust* with a dynamic value: XSS
- React dangerouslySetInnerHTML with a dynamic value: XSS
- DOM XSS: URL, referrer or window.name inserted as HTML
- Node.js reflected XSS: request input in an HTML response
- NextAuth allowDangerousEmailAccountLinking enabled
- NextAuth Auth.js debug: true logs tokens in production
Check your own repository for this
vetkit runs this rule as part of a repository audit, alongside secret scanning, dependency vulnerabilities, code quality and AI code risk checks. It reads a temporary checkout and never executes your code.
Start with the free Security Quick Scan · See how the platform works
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.