Get this on every PR automatically. Webhook fires, AI reviews, you approve.
Install on payloadcms/payload →
// reviewed by pulllight
PullLight found 2 issues
2 high
// convert to your repo
PullLight caught 2 2 high on this PR.
Install on payloadcms/payload to get this on every PR automatically — 60 seconds.
Findings
2 issues
high
injection
XSS via dangerouslySetInnerHTML — blockData.htmlContent is passed directly to dangerouslySetInnerHTML without DOMPurify sanitization. An attacker controlling this rich-text field value can inject script tags or event handlers to run arbitrary JavaScript in the admin browser — credential theft, session hijack, or data exfiltration. Fix: dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(blockData.htmlContent) }}
// packages/richtext-lexical/src/field/features/blocks/component/BlockContent.tsx:47
⚡ Suggested fix
dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(blockData.htmlContent) }}
high
injection
XSS via dangerouslySetInnerHTML — node.htmlString reaches the DOM sink unsanitized. Rich-text editors storing user-authored HTML are a classic XSS vector when the value flows into dangerouslySetInnerHTML without a sanitizer. Fix: dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(node.htmlString) }}
// packages/richtext-lexical/src/field/features/blocks/component/InlineHTMLRenderer.tsx:23
⚡ Suggested fix
dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(node.htmlString) }}