---
id: 2313
title: "Secure Markdown Rendering in React: Balancing Flexibility and Safety"
source_domain: hackerone.com
source_url: "https://www.hackerone.com/blog/secure-markdown-rendering-react-balancing-flexibility-and-safety"
published_at: "2023-12-01T06:13:54Z"
tags: ["web-security", "xss", "react", "frontend-security", "markdown", "dompurify", "sanitization"]
phying_url: "https://phying.com/item/2313"
lang: en
---

# Secure Markdown Rendering in React: Balancing Flexibility and Safety

## Summary

Rendering user-generated Markdown risks XSS when output becomes HTML. react-markdown escapes HTML by default; pair it with DOMPurify sanitization before dangerouslySetInnerHTML if HTML is required.

## Intelligence Metadata

- **Sources:** hackerone.com
- **Published:** 2023-12-01T06:13:54Z
- **Original:** https://www.hackerone.com/blog/secure-markdown-rendering-react-balancing-flexibility-and-safety
- **Phying News:** https://phying.com/item/2313