Medium severityC#Cross-Site Scripting (XSS)MEDIUM confidence

HTML Raw Nonliteral

Html.Raw emits its argument as unescaped HTML; when the value is not a compile-time literal it can carry attacker-controlled markup and produce stored/reflected XSS (CWE-79).

Standards mapping

CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
OWASP Top 10: A03:2021 - Injection
OWASP ASVS: V5.3.3 (L1)

Vulnerable vs. safe

Flagged by this check

return Html.Raw(userContent);

Passes - the safe pattern

return Html.Raw("<b>static</b>");

Why it matters & how to fix it

Html.Raw emits its argument as unescaped HTML; when the value is not a compile-time literal it can carry attacker-controlled markup and produce stored/reflected XSS (CWE-79). Remove Html.Raw and let Razor auto-encode the value, or sanitize the HTML with a vetted sanitizer (e.g. HtmlSanitizer) before rendering.

References

Rule ID integsec.csharp.xss.html-raw-nonliteral - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.

TurboPentest runs this check automatically

Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.

Start a pentest

Related checks