Will It Vibe?javascript: URL in a JSX attribute
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
A javascript: URL in href/src/action runs script when the link or resource is activated. React warns on this and blocks it in newer versions; it is an XSS vector when any part of the URL is dynamic.
Why it matters
A javascript: URL in an href or src runs script when the element is activated. When any part of the URL is user-controlled, that is a cross-site scripting hole. Modern React already refuses to render these and logs a warning, so the code is both unsafe and broken on newer versions.
How to fix it
If the anchor performs an action rather than navigating, make it a real button element with an onClick handler. If it is a placeholder like href="javascript:void(0)", replace it with a button or, for a non-navigating link, href="#" plus preventDefault, or better, an appropriate route. Never assemble a javascript: URL from a variable.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo