BETA Shoulder is in beta — Findings may sometimes be wrong. Your feedback shapes what we fix next. Share feedback

Cross-Site Scripting (XSS) via Response

Description

Detects user input flowing into HTTP responses without proper encoding or sanitization.

What Shoulder detects

Untrusted input from {source} flows directly into HTTP response at {sink}. This allows an attacker to inject malicious scripts (XSS attack).

How to fix

Use template engines with auto-escaping or sanitize user input before output.

```javascript
const sanitizeHtml = require('sanitize-html');
const clean = sanitizeHtml(userInput);
res.send(`<div>${clean}</div>`);
```

Learn more: https://shoulder.dev/learn/javascript/cwe-79/xss

Applies to

Frameworks

nodejs express fastify koa hapi nestjs lambda serverless graphql

References

Scan for this issue

Detect with Shoulder CLI
npx @shoulderdev/cli trust --rule=javascript-xss .

Real-world examples

Known CVEs in the Cross-Site Scripting (XSS) vulnerability class that this rule helps detect.

Related rules