FiftyOne XSS fix: field descriptions rendered via Markdown instead of dangerouslySetInnerHTML

Key Vulnerability Summary Vulnerability Overview Type: Cross-Site Scripting (XSS) vulnerability Location: Field descriptions within the FiftyOne application Root Cause: Field descriptions are rendered directly as HTML using without escaping or filtering, allowing malicious scripts to be injected and executed Fix PR: #8117 (merged into ) Impact Scope Affected Component: Field info component within Affected Feature: Expanded field information descriptions Impact Surface: FiftyOne application layer (App: FiftyOne application changes) Risk: An attacker can inject a script by crafting a malicious field description, which is executed when a user views the field details Fix Details Core Change: Replaced with a Markdown renderer (render description with markdown) Commit: — "render description with markdown" Testing: The exploit was confirmed on the unpatched code, and the fix was applied; new/verified tests for the renderer, allowing verification without scripts Effect: Field descriptions are now rendered via Markdown, providing a consistent and safe viewing experience; collapsed-state behavior remains unchanged POC / Exploit Code The screenshots do not contain a standalone POC code block; they only show the field description rendering interface (including the field list with , , , and the description rendering area). Verification & Status CI (OSS): 1 flaky test case ( , related to video annotation temporal detection, not introduced by this PR), 262 passed, 22 skipped CI (FOE): 8 lines in the external specification section are hidden; see the sync PR comments for details Review: Approved by sashankaryal; the PR has been merged, and the branch has been deleted CodeRabbit Assessment: Estimated effort 1 (Trivial), approximately 3 minutes

Goal Reached Thanks to every supporter — we hit 100%!

FiftyOne XSS fix: field descriptions rendered via Markdown instead of dangerouslySetInnerHTML

More from this source