How to Fix CWE-79: Cross-Site Scripting (XSS)

Step-by-Step Remediation

1. Encode all user output using context-appropriate encoding (HTML, JavaScript, URL, CSS)
2. Implement Content Security Policy (CSP) headers
3. Use framework auto-escaping (React JSX, Angular templates)
4. Validate and sanitize input on the server side
5. Use HttpOnly and Secure flags on session cookies

Code Example

// VULNERABLE: Direct insertion of user input
element.innerHTML = userInput;

// SAFE: Use textContent (auto-escapes)
element.textContent = userInput;
// Or use DOMPurify for HTML content
element.innerHTML = DOMPurify.sanitize(userInput);

Recent Vulnerabilities (CWE-79)

180 vulnerabilities in our database match Cross-Site Scripting (XSS).