Including unsanitized user input in HTTP responses exposes your application to cross-site scripting (XSS) attacks. This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users, posing a significant security risk.
Remediation Guidelines
Do not include user input directly in a response, as this can lead to XSS vulnerabilities.
res.send(req.body.data); // unsafe
Instead, sanitize user input before including it in a response. Use library functions or frameworks designed for input sanitization to ensure that user data cannot be interpreted as executable code.
