Why is AI chat output dangerous to render?

The model repeats what users plant. A message containing an tag can come back rendered in another user's chat — the model is a confused deputy, not a trusted author.

I only render my own markup — why was I flagged?

The scan can't prove the content is static. If the flagged value is authored markup that never touches user or model input, note that in the fix PR — but audit the data flow first: most 'static' banners started static.

DOMPurify on the client, sanitize-html on the server, or rehype-sanitize in markdown pipelines. Or drop raw HTML entirely — react-markdown without rehype-raw escapes by default.

C38

Input handling

Raw HTML Render Check — Can a Chat Message Run Script in Another User's Browser?

DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee.

What the issue is

User or AI content rendered as raw HTML is stored XSS: a planted message or profile field runs script in every other user's browser — session theft, silent data mutation.

Why AI tools generate it

AI chat UIs render model answers as markdown-turned-HTML; AI scaffolds wire dangerouslySetInnerHTML because it makes markdown work, and the sanitizer is the step tutorials skip.

How DevMeth detects it

A code scan flags raw-HTML sinks (dangerouslySetInnerHTML, innerHTML, {@html}, HTML-enabled markdown renderers) with no sanitizer in the file, and react-markdown rehype-raw setups. Static markup and sanitizer-protected paths are not flagged.

C38

What a finding looks like

High

User or AI-generated content is rendered as raw HTML

WHAT WE FOUND

C38 — masked sample

Sample — illustrative and masked exactly as a real report shows it. Run a free scan to see your own results.

The fix, in three steps

Add DOMPurify (or sanitize-html / rehype-sanitize) on each flagged path — or switch to react-markdown without rehype-raw, which escapes HTML by default.

Run a free scan and each finding carries a paste-ready fix prompt you can act on.

Try a free scan

FAQ

DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee. A clear result means each known pattern was checked and found clear or not applicable for your app; it is not a guarantee of security.