Unsanitized innerHTML / dangerouslySetInnerHTML
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
Writing variable content into innerHTML or dangerouslySetInnerHTML without sanitizing is a common XSS vector.
Why it matters
Anything assigned to innerHTML or dangerouslySetInnerHTML is parsed as live HTML, so a user-controlled value there lets attackers inject scripts that run as your users, stealing sessions or defacing pages. React escapes normal children automatically, and this API deliberately turns that protection off. Values that look safe today tend to pick up user data later.
How to fix it
Where the content is plain text, switch to textContent or normal React rendering, which escape automatically. Where you genuinely need to render HTML (rich text, CMS output), sanitize it first with DOMPurify and keep the sanitize call at the render site. Avoid building HTML strings by concatenation entirely.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo