[omouse]

Agreed and this is why React has been given a pass I think, because it's only for display purposes.

[vmasto]

Really it doesn't matter if it's for display purposes or not. It all boils down to implementation. I can make a view library riddled with XSS vulns in very little time.

[spicyj]

React is actively maintained and doesn't have any known security vulnerabilities.