SEC011warningPro

unsanitized-html

HTML stored without sanitization may enable XSS

Applies to: JavaScript, Python, TypeScript

Why this matters

Storing raw HTML from users and rendering it later allows XSS attacks. Attackers can inject malicious scripts, tracking pixels, or phishing content. Use DOMPurify, sanitize-html, or similar to filter dangerous content.

Catch it before it ships

pip install stablestack # or: npx stablestackstablestack # scans your project, SEC011 includedstablestack explain SEC011

SEC011 is part of the Pro rule set. See pricing — the free tier ships 24 checks with no signup.

False positive in your codebase? Suppress a single line with # noqa: SEC011

More Security checks

SEC001

hardcoded-secret

Hardcoded secrets in code can be leaked and are hard to rotate

SEC002

sql-injection

SQL queries built with string concatenation are vulnerable to injection

SEC003

eval-usage

eval() executes arbitrary code and is a security risk

SEC004

insecure-random

Non-cryptographic random is predictable and insecure for tokens/passwords

SEC005

inner-html-xss

Direct innerHTML assignment can lead to XSS vulnerabilities

SEC006

webhook-security-bypass

Webhook signature verification should never be skipped

SEC007

oauth-state-validation

OAuth callback missing state parameter validation

SEC008

plaintext-secrets

Sensitive tokens stored without encryption in database schema