React dangerouslySetInnerHTML: your components are open doors to XSS
> TL;DR: Using dangerouslySetInnerHTML without sanitization exposes your app to XSS.
The CMS content trap
When your React app displays HTML from a CMS, you probably use dangerouslySetInnerHTML. The name is a warning.
The risk
Malicious JavaScript in injected content executes in the user's browser. Cookie theft, phishing redirect, data exfiltration.
The solution: DOMPurify
dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(content) }}
What we find
40% of React apps we audit use dangerouslySetInnerHTML without sanitization.
Key Takeaways
Building HR, payroll, or recruiting software? CleanIssue performs security audits for HR SaaS in real-world conditions, no source code access needed. For a first read of your exposure, start with an external review of your application.
Related articles
Three adjacent analyses to keep exploring the same attack surface.
WordPress REST API: 7 dangerous endpoints enabled by default
Your WordPress exposes sensitive data via REST API without you knowing. Here are 7 endpoints to check now.
Next.js: common security mistakes in Server Components applications
Exposed Server Actions, insecure data fetching, API route auth gaps, middleware bypass — the Next.js App Router flaws we find in audits.
Laravel: when Ziggy exposes the complete map of your application
Ziggy route exposure gives attackers a complete map of your Laravel app architecture.
Sources
Editorial analysis based on official vendor, project, and regulator documentation.
Related services
If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.