[leonardopainter]

<img src='x' onerror='alert(1)'>

https://developer.mozilla.org/en-US/docs/Web/API/Element/inn...

[leonardopainter]

In terms of the placeholders in JSX, no they are escaped.

[TekMol]

True.

But the same issue with reacts way.