DOM sink (innerHTML / html() / v-html)
innerHTML, outerHTML, insertAdjacentHTML, document.write, jQuery html(), React dangerouslySetInnerHTML, Vue v-html, Angular [innerHTML] without bypassing sanitizer correctly.
Tags: xss, dom, spa
Typical severity: P2-P4
What it becomes
A sink without a source is inventory. A sink plus any attacker-controlled source is XSS.
Where to look
Markdown renderersnotification toastssearch highlightserror messagesi18n stringsemail templates rendered client-side
Chains
- Reflected XSS — location.hash, query, postMessage, or document.referrer reaches the sink.
- Stored XSS — Profile fields, comments, filenames, or webhook payloads are stored then rendered.
- CSP bypass — If a gadget already executes, look for nonce reuse, JSONP, or Angular/template sinks that CSP missed.
Notes
- DOM clobbering can retarget a sanitizer check (window.location forged via form/img name).
- Framework auto-escape does not apply to v-html / [innerHTML] / markdown libraries.