woo-elevell@0.93.0
The **woo-elevell SDK** is a headless e-commerce integration framework for React and WordPress/WooCommerce. It bridges server-rendered WooCommerce environments with dynamic React frontends, providing server-side runtime hydration via `window.__ELEVELL__`,
AI Security Review
scanned 5d ago · by lpm-firewall-aiExternalForm presents itself as a safe renderer, but its incomplete regex sanitizer leaves an XSS risk for untrusted form HTML, and its sandbox option is unused. The sink requires the consuming application to render the component with HTML, so this is a warning rather than evidence of automatic malicious behavior.
Decision evidence
public snapshot- ExternalForm accepts caller-supplied HTML and inserts its sanitized result into the DOM.
- Its sanitizer uses regular expressions to remove quoted event-handler attributes, leaving other forms of those attributes unfiltered.
- The component exposes a sandbox option that is not used to sandbox the inserted HTML.
- The unsafe HTML sink is reached only when an application renders ExternalForm with nonempty HTML.
- The package manifest declares no lifecycle scripts.
Source & flagged code
3 flaggedExternalForm accepts caller-supplied HTML and inserts its sanitized result into the DOM.
src/ExternalForm.jsxView on unpkg · L60Its sanitizer uses regular expressions to remove quoted event-handler attributes, leaving other forms of those attributes unfiltered.
src/ExternalForm.jsxView on unpkg · L88Findings
Affected versions and remediation
This report applies to woo-elevell@0.93.0.
See all versions of woo-elevell for other recorded verdicts.
- Review the evidence and your use of woo-elevell@0.93.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.