How severe is cross-site scripting (xss) via innerhtml?

Shield rates this high (CVSS 7.4), classified as CWE-79.

Rules / JavaScript / TypeScript

SHIELD-JS-003

Cross-Site Scripting (XSS) via innerHTML

highJavaScript / TypeScriptCWE-79CVSS 7.4

Setting innerHTML with user-controlled data can lead to XSS attacks.

Use textContent, or sanitize with DOMPurify before assigning to innerHTML / dangerouslySetInnerHTML.

Vulnerable — Shield flags thiscomments.js

function renderComment(comment) {
  const el = document.getElementById("comment-box");
  el.innerHTML = comment.body;
}

Fixed — scans cleancomments.js

function renderComment(comment) {
  const el = document.getElementById("comment-box");
  el.textContent = comment.body;
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JS-003, the fixed one does not.