CodeVetter · local evidence export

Reflected XSS via dangerouslySetInnerHTML in React

codevetter-public-benchmark/ts-xss

detected · high confidence

Verification

Code reviewcompleted

Qualified static finding recorded.

Executable testnot verified

No exact-current runtime evidence is included.

Audiencenot run

No audience validation occurred.

highbenchmark ground truth

User-supplied comment body is rendered as raw HTML via dangerouslySetInnerHTML without any sanitization, enabling stored/reflected XSS.

source.tsx:12