GrepRules
Sign inPublish rule
Explore/cve-2026-29048-insecure-widget-label-encoding-default

CVE-2026-29048: Insecure Widget Label Encoding Default

UI widgets or components that disable output encoding by default (e.g., `encodeLabel = false`) introduce Cross-Site Scripting (XSS) risks. In a secure-by-default architecture, components should encode text labels by default. Raw HTML output should only occur when it is explicitly configured during component invocation, not as a blanket default. Change the pr

Provally CuratedPublic repositoryMediumMedium confidenceVerifiedApache-2.0PHPβ
greprules fetch cve-2026-29048-insecure-widget-label-encoding-default --engine opengrep

Description

UI widgets or components that disable output encoding by default (e.g., `encodeLabel = false`) introduce Cross-Site Scripting (XSS) risks. In a secure-by-default architecture, components should encode text labels by default. Raw HTML output should only occur when it is explicitly configured during component invocation, not as a blanket default. Change the pr

License
Apache-2.0
Source context
Public repository
Source
Provally CVE rule catalog
Validation status
Verified
Quality signals
145 downloads0 direct145 via packs
· 0 stars · Quality score 72How quality works
Included packs
2 packs