mdn/content

setHTML() / Sanitizer explictly call out that re-parsing (mXSS) is still a danger

Closed

#43,386 opened on Mar 9, 2026

View on GitHubContributor guide
 (2 comments) (0 reactions) (0 assignees)Markdown (23,184 forks)batch import
Content:WebAPIhelp wanted

Repository metrics

Stars
 (10,905 stars)
PR merge metrics
 (Avg merge 7d 3h) (147 merged PRs in 30d)

Description

MDN URL

https://developer.mozilla.org/en-US/docs/Web/API/Element/setHTML

What specific section or headline is this issue about?

No response

What information was incorrect, unhelpful, or incomplete?

Nothing

What did you expect to see?

I think we should try to explain that it's unsafe to something like this:

div.setHTML(code);
other_div.innerHTML = div.innerHTML

It's also unsafe to use the result of innerHTML save it in a database and serve again without using setHTML.

setHTML can't protect against bugs caused by the HTML code being parsed again (mXSS)

Do you have any supporting links, references, or citations?

https://wicg.github.io/sanitizer-api/#mutated-xss

Do you have anything more you want to share?

No response

Contributor guide

Research direction
Explain that using setHTML() does not protect against mXSS vulnerabilities when the result is re parsed via innerHTML or stored and served again without setHTML(). Refer to the Sanitizer API specification's section on mutated XSS.
Tech stack
javascripthtml
Domain
documentation
Issue type
Documentation
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
1
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Under 1 hour
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
None
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
90