PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Secure Markdown Rendering in React: Balancing Flexibility and Safety

hackerone.com | vulnerability | #web-security | #xss | #react | #frontend-security | #markdown | #dompurify | #sanitization
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Rendering user-generated Markdown risks XSS when output becomes HTML. react-markdown escapes HTML by default; pair it with DOMPurify sanitization before dangerouslySetInnerHTML if HTML is required.
Published
Collected

Related coverage

blog · hackerone.com
Build a Simple Blog Site with Next.js and Markdown
Walkthrough for building a Markdown-driven blog with Next.js: project scaffolding, the pages directory convention, and rendering homepage and author pages from Markdown files.
Critical · vulnerability · hackerone.com
CVE-2025-55182: Unauthenticated React Exploit Affects Millions of Sites
A critical CVE-2025-55182 React RCE flaw affects millions of sites. Get impact details, affected versions, indicators of compromise, and urgent remediation steps.
vulnerability · bishopfox.com
Submit and Execute: Weaponizing Reflected XSS in Siemens Teamcenter's Login Redirect (CVE-2026-58113)
CVE-2026-58113 is a zero-interaction XSS in Siemens Teamcenter’s login redirect that let Bishop Fox silently reassign workflow delegation on a victim’s…
vulnerability · bishopfox.com
LEXSS: Bypassing Lexical Parsing Security Controls
Introducing LEXSS: XSS that bypasses lexical sanitizers by abusing mismatches between HTML parsing and lexical parsing, letting special HTML tags run JavaScript where filters were believed effective.
Critical · vulnerability · xbow.com
React2Shell (CVE-2025-55182): A Wake-Up Call for Modern Web Security and How XBOW Helps You Respond
Covers React2Shell (CVE-2025-55182), an unauthenticated RCE in React Server Components' serialization that also affects Next.js and more, and how to quickly scope exposure.
vulnerability · yeswehack.com
How to find IDOR, stored XSS, information disclosure vulnerabilities – from our #1 hunters for these CWEs
Learn how to find IDOR, stored XSS and information disclosure vulnerabilities with practical tips and techniques from YesWeHack’s top-ranked bug hunters.
Back