Skip to content

Rule · Lint

JSON-LD injected with JSON.stringify without escaping <

lint/dangerously-set-jsonld-unescapederrorvoid lintupdated

Why it matters

JSON.stringify doesn't escape <, so any string containing (a user name, a CMS title) closes the script tag and injects HTML — a stored XSS vector — or breaks the structured data.

How to fix it

Escape < when serialising: JSON.stringify(data).replace(/, via a shared component.

Example

tsx
export function JsonLd({ data }: { data: object }) {
  return <script type="application/ld+json"
    dangerouslySetInnerHTML={{ __html: JSON.stringify(data).replace(/</g, '\\u003c') }} />
}

References

More lint rules

void lint reports 67 rules in this category. Static source checks with no browser: Tailwind v4 silent failures, Next.js 16 API traps, React render-body bugs, accessibility markup, SEO files and motion hygiene.