JSON-LD XSS possible via JSON.stringify fix with \u003c

The author explains that JSON.stringify is unsafe when directly embedded inside HTML script tags because unescaped angle brackets in strings can cause the HTML parser to prematurely close the element, enabling stored cross-site scripting vulnerabilities. To fix this, developers should replace all occurrences of less-than signs with their Unicode escape sequence '\u003c' before serialization. The article also provides a test snippet to verify that a serializer safely handles hostile input. Open article →