Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) |
| OWASP | A07:2017 - Cross-Site Scripting (XSS) |
| Confidence Level | Low |
| Impact Level | Low |
| Likelihood Level | Low |
Description#
Accepting user input and rendering it as HTML in Monaco Editor hovers with ‘supportHtml’ enabled can allow malicious scripts to execute in the browser. Avoid using untrusted or dynamic user input to generate hover content when HTML support is on.
Impact#
If exploited, attackers could inject and run arbitrary JavaScript in users’ browsers (XSS), potentially stealing session data, hijacking accounts, or compromising the integrity of your application and its users.