What is cross-site scripting (XSS)?
Cross-site scripting (XSS) is an attack where someone gets their own code to run inside your pages, in other people's browsers. It usually happens when your app shows text a user typed, like a comment or a display name, as if it were part of the page. Once that code runs, it can act as the visitor: read what they see, steal their login and send requests in their name.
Also called: XSS
ON THIS PAGE
What it means
Your pages are built from HTML, which can contain scripts. If your app takes something a user typed and puts it into the page as HTML, a script hidden in that text is treated like your own code.
The danger is not to you, it is to everyone else who opens the page. One bad comment on a public page can run in the browser of every visitor, including an admin.
Why it matters for vibe-coded apps
AI tools often reach for the quickest way to display rich text, and that can mean switching off the safety that your framework gives you by default.
- A visitor's login session can be stolen, so someone else can act as them.
- People can be sent to a fake login page that looks like yours.
- Your site can be changed on screen for everyone who views the infected page.
Example
A comment section that shows whatever people post.
// A comment containing <script>...</script> will run for every visitor
<div dangerouslySetInnerHTML={{ __html: comment.text }} />// React escapes the text, so a script is shown as words, not run
<div>{comment.text}</div>If you really need formatted text, run it through a sanitiser such as DOMPurify first.
How to check if your app has this problem
- 1Search your code for dangerouslySetInnerHTML, innerHTML and v-html.
- 2For each one, find where the text comes from. If a user can write it, it is a risk.
- 3Type <b>test</b> into a comment or name field. If it shows up in bold, your page is treating input as HTML.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Show user text as plain text. Frameworks like React, Vue and Svelte do this by default when you use normal templates.
- 2Where you must show HTML, clean it with a sanitiser library first.
- 3Add a Content-Security-Policy header so the browser refuses scripts you did not approve.
- 4Run a check again to confirm.
Find every place in my project where user-written text is put into the page as raw HTML (dangerouslySetInnerHTML, innerHTML, v-html or similar). Change each one to show the text as plain text. If formatting is needed, sanitise the text with DOMPurify first. Don't change anything else.
Check if your app has this problem
Paste your website and we'll check for cross-site scripting (XSS) issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- Cross-site request forgery (CSRF)Another website tricks a logged-in user's browser into acting on your app.
- Security headersSettings your site sends that tell browsers how to protect visitors.
- SQL injectionAn attacker types database commands into your app and it runs them.
- JSON Web Token (JWT)A signed pass your app hands a user after they log in.
Related reading
Need help?
Not sure what this means for your app? Our team will explain it in plain English.