Vulnerability Details

• File Path: orbit-app/src/components/CommentsSection.jsx
• Vulnerability Type: Cross-Site Scripting (XSS)
• Risk Level: Critical

Explanation:
The code renders user-supplied comments using React's dangerouslySetInnerHTML, directly injecting the cmt.comment property into the DOM as HTML. Since comments are submitted by users and fetched from the backend, an attacker can submit a comment containing malicious HTML or JavaScript (e.g., <script>alert(1)</script>). When this comment is rendered, the browser will execute the script, resulting in a stored XSS vulnerability. This allows attackers to steal session cookies, perform actions as other users, or deface the site. The root cause is the lack of sanitization or encoding of user input before rendering it as HTML.

Please review and address the issue accordingly.