xss
Safeguard articles tagged "xss" — guides, analysis, and best practices for software supply chain and application security.
86 articles
react-number-format: A Security Guide for Safe Input Handling
react-number-format is a popular library for formatting numeric and masked inputs. Here is how to use it without opening XSS or validation gaps.
marked on npm: Security Review and Safe Usage
marked is a fast Markdown parser, but it does not sanitize output and older versions carried a ReDoS bug. Here is how to use marked npm without opening an XSS hole.
CVE-2021-41183: jQuery UI Datepicker XSS and How to Fix It
CVE-2021-41183 is a cross-site scripting flaw in the jQuery UI Datepicker's *Text options, fixed in 1.13.0. Here is the risk and the remediation.
DOM-Based XSS Attacks: How They Work and How to Prevent Them
A DOM based XSS attack executes entirely in the browser, which is why your server-side filters and access logs never see it. Here is how the source-to-sink flow works and what actually stops it.
JavaScript Security Best Practices Every Team Should Actually Follow
Most JavaScript security incidents come from a handful of repeated mistakes. These are the best practices that prevent them, from XSS to the npm dependency graph.
The xss npm Package: Sanitizing HTML Input Correctly
The xss npm package is a whitelist-based HTML sanitizer for Node and the browser. It works well — when you sanitize in the right place, with the right whitelist, for the right output context.
CVE-2019-8331: The Bootstrap XSS Vulnerability, Explained
CVE-2019-8331 let attackers inject script through Bootstrap's tooltip and popover template options, a pattern that recurred across several Bootstrap CVEs before 4.3.1 finally closed it.
What Is XSS? Cross-Site Scripting Full Form and Basics
XSS is short for cross-site scripting, a vulnerability that lets attackers run malicious scripts in a victim's browser. Here's how it works, its three main types, and how it's actually caught.
jQuery 3.5.1 Vulnerabilities: What Was Actually Fixed
jQuery 3.5.1 closed a second cross-site scripting hole in the htmlPrefilter regex that 3.5.0 had only partially patched — here's exactly what changed and why old jQuery bundles still trip scanners.
React Application Security Guide
Securing React applications from XSS, dependency vulnerabilities, and common frontend attack patterns.
Zimbra Collaboration CVE-2023-37580: XSS Zero-Day Exploited by Four Nation-State Groups
A reflected XSS vulnerability in Zimbra Collaboration was exploited by four distinct threat groups targeting government organizations worldwide. The campaign showed how even 'low severity' bugs enable espionage.
Cross-Site Scripting (XSS) Prevention: Context-Aware Encoding and Modern Defenses
XSS remains a top web vulnerability because output encoding is context-dependent. Here is how to get it right across HTML, JavaScript, URL, and CSS contexts.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.