High severityJavaScript / TypeScriptCross-Site Scripting (XSS)HIGH confidence

Reflected XSS Response Tainted Input

Untrusted request data is written to the HTTP response body without encoding, enabling reflected XSS.

Standards mapping

CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
OWASP Top 10: A03:2021 - Injection
OWASP ASVS: V5.3.3 (L1)

Vulnerable vs. safe

Flagged by this check

res.send(req.query.name);

Passes - the safe pattern

res.send(escapeHtml(req.query.name));

Why it matters & how to fix it

Untrusted request data is written to the HTTP response body without encoding, enabling reflected XSS. HTML-encode output (e.g. escape-html) or render via a templating engine with auto-escaping.

References

Rule ID integsec-js-reflected-xss-response-taint - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.

TurboPentest runs this check automatically

Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.

Start a pentest

Related checks