The React Javascript framework was generally designed to prevent cross-site scripting (XSS) by default. However, in some cases, XSS is still possible in React web applications, especially when developers deliberately use some unsafe constructs that React provides.
Learn more about cross-site scripting (XSS).