xss
Safeguard articles tagged "xss" — guides, analysis, and best practices for software supply chain and application security.
86 articles
Is react-hot-toast Safe to Use? A Security Review
react-hot-toast is a small, well-maintained React notification library with a clean security record, but the way you render toast content is where risk creeps in.
GitHub Copilot code security: XSS vulnerabilities found in React
Copilot commonly suggests dangerouslySetInnerHTML and unsanitized DOM writes in React. Here's the data on AI-generated XSS risk and how to catch it.
PrismJS: Vulnerability History and Hardening Your Syntax Highlighting
The npm prismjs package has patched ReDoS, plugin XSS, and a DOM clobbering flaw over the years. Here is the full history and how to run a syntax highlighter safely.
OWASP Top 10 and XSS: Where Cross-Site Scripting Fits Now
In the OWASP Top 10, XSS is no longer its own category. As of the 2021 list it lives inside A03: Injection. Here is what changed, why, and how to defend against it.
localStorage Security: Why You Shouldn't Keep Tokens There
localStorage security comes down to one fact: any script on your page can read it. That makes it the wrong place for auth tokens and anything sensitive.
react-quill and Quill: XSS History and Safe Rich-Text Editing
Using Quill in React means understanding CVE-2021-3163, the react-quill maintenance gap, and why editor output must always be sanitized server-side before display.
CVE-2022-31160: Understanding the jQuery UI Checkboxradio XSS
CVE-2022-31160 is a cross-site scripting flaw in jQuery UI's checkboxradio widget, fixed in 1.13.2. Here is how it works and how to remediate it.
AngularJS security fundamentals
AngularJS has been unpatched since January 2022, yet it still runs in production. Here's the CVE history, the sandbox saga, and how to find your exposure.
react-md-editor: Using @uiw/react-md-editor Securely
How to use react-md-editor safely: what @uiw/react-md-editor does, the XSS risk in markdown preview, and why rehype-sanitize is not optional for untrusted input.
Antd Injection: Preventing XSS in Ant Design Applications
Antd injection risk is not a flaw in the component library itself but in how you feed it untrusted data. Here is where the danger lives and how to close it.
prism-react-renderer: Safe Syntax Highlighting in React
prism-react-renderer gives you tokenized syntax highlighting in React without dangerouslySetInnerHTML. Here is how it works, why that matters for XSS, and how to keep the dependency healthy.
tinymce-angular Security: What to Know Before You Ship
The tinymce-angular wrapper is thin, but it ships a full rich-text editor whose sanitization gaps have produced real XSS CVEs. Here is how to use it safely.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.