Expired50% confidenceFactExact time
innerHTML carries an XSS risk because it parses the string as HTML and executes any script tags or event handler attributes (such as onerror) within it.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
7/2/2026
First Seen
Valid until: 9/30/2026(expired)
Sources
JavaScript Fundamentals: A Complete Guide to Variables, DOM Manipulation, Event Handling, and API Calls
bilibiliFireUG技术社区6/21/2026
Related Claims
UnverifiedAllowing users to submit rich text content containing HTML markup can lead to XSS (Cross-Site Scripting) attacks, where malicious users can inject script tags to execute arbitrary JavaScript code.71% similarUnverifiedMarkdown 解析器渲染 HTML 时的主要安全威胁是跨站脚本攻击（XSS），因标准 Markdown 允许内嵌原生 HTML68% similarUnverified无JS页面天然规避了跨站脚本（XSS）攻击面，在安全敏感的内容展示场景下是有意义的架构选择63% similarUnverifiedXSS 防护主流方案包括输出净化（DOMPurify、sanitize-html）、沙箱隔离（iframe sandbox、Web Workers）和从源头禁用原始 HTML 内嵌63% similarUnverified浏览器中HTMLElement继承自Element，Element继承自Node，document的原型链为HTMLDocument→Document→Node→EventTarget→Object60% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/43261API
curl https://kongchang.com/api/v1/knowledge/claims/43261MCP
get_claim(id=43261)