Unescaped HTML

aura:unescapedHtml outputs the value as unescaped HTML, which can introduce security vulnerabilities in your code. Use lightning:formattedRichText whenever possible. Alternatively, if you want to display plain text without HTML formatting, use lightning:formattedText instead.

When your org uses Lightning Locker or Lightning Web Security, your HTML output is sanitized automatically.

Use the value attribute to pass an HTML string. The string is rendered as-is in the DOM.

1<!-- myComponent.cmp -->
2<aura:component>
3  <aura:attribute name="htmlContent" type="String" />
4  <aura:handler name="init" value="{!this}" action="{!c.doInit}" />
5  <aura:unescapedHtml value="{!v.htmlContent}" />
6</aura:component>

This example renders as “Hello World”. The <script> tag is removed from the output.

1// myComponentController.js
2({
3  doInit: function (cmp) {
4    // htmlContent must come from a trusted, sanitized source
5    cmp.set(
6      "v.htmlContent",
7      "<strong>Hello</strong> <em>World</em><script>...</script>",
8    );
9  },
10});

Any markup you place inside <aura:unescapedHtml> is removed. Only the value attribute is rendered.

1<!-- The inner <p> is not rendered -->
2<aura:unescapedHtml value="{!v.html}">
3  <p>This content is ignored.</p>
4</aura:unescapedHtml>

Only use aura:unescapedHtml when you specifically need the browser to interpret the HTML tags.

A trusted source means the HTML was either generated by your own code or sanitized before being stored or returned.

Trusted sources include:

• HTML returned from Apex that explicitly strips dangerous tags
• Content from Salesforce rich text fields, which the Salesforce Platform sanitizes before storage
• Static strings defined directly in your component or controller

Untrusted sources must be sanitized before use. Untrusted sources include:

• User-entered form input
• URL parameters or query strings
• Responses from third-party APIs

aura:unescapedHtml does not bypass Salesforce’s Content Security Policy (CSP). Inline <script> tags embedded in the value string doesn’t execute. However, CSP does not prevent all attack vectors. Event handler attributes such as onerror or onload can still run JavaScript if the HTML isn’t sanitized.

CSP blocks <script>, but not event handlers such as onerror.

1<!-- Always sanitize to prevent XSS vulnerabilities -->
2<img src="x" onerror="alert('XSS')" />

CSP reduces some risk but isn’t a substitute for sanitization.

aura:unescapedHtml passes the string directly to the DOM without modification. Consider these alternatives for your use case.

• lightning:formattedText treats its value as plain text and escapes HTML characters before rendering.
• lightning:formattedRichText renders rich text from Salesforce fields.

• Security for Lightning Components: Lightning Web Security Sanitization
• Security for Lightning Components: Disable Sanitization