Code injection with javascript: URL in JSX

ID

javascript.react_javascript_url

Severity

high

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Injection

Language

JavaScript

Tags

ASVS50:v1.3.5, ASVS50:v1.3.7, CWE:94, React

Description

Rationale

Remediation

Configuration

The detector has no specific configurable parameters.

References

  • CWE-94 : Improper Control of Generation of Code ('Code Injection').

  • OWASP Top 10 2025 - A05 : Injection.