OOB Employee Center "My Approvals" Widget Flagged for DOM Manipulation in Instance Scan

[VSNow User]

Hi All,

We have observed that the out-of-the-box (OOB) My Approvals widget in Employee Center is being flagged by Instance Scan for DOM Manipulation findings.

The widget has not been customized on our instance, and the reported code appears to be part of the OOB implementation. Since DOM manipulation findings are generally raised for custom code, we are trying to understand whether this is an expected result for the OOB widget.

Could anyone help clarify:

• Has anyone else encountered DOM Manipulation findings on the OOB My Approvals widget?
• Is this a known issue or expected behavior in certain ServiceNow releases?
• Are there any recommended actions (mute the finding, exclude it, or apply a fix)?
• Has ServiceNow provided any guidance regarding scan findings raised against OOB widgets?

Any insights or recommendations would be greatly appreciated.

Thanks. 

[Ankur Bawiskar]

@VSNow User 

I think instance scan checks the config (OOTB or Custom) and flags it

You can inform your customer about this findings that it's OOTB and it's platform feature

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

[VSNow User]

Hi @Ankur Bawiskar 

Thanks for the quick response.

Here’s what we have validated so far:

We identified this issue in our instance when we cloned the OOB widget to meet a business requirement. As part of our standard deployment process, we run an Instance Scan on the update set before promoting changes to higher environments.

During the scan, not only was the cloned widget flagged, but the original OOB widget was also reported with the same DOM Manipulation finding. Interestingly, we have not been able to reproduce this behavior on Personal Developer Instances (PDIs).

We have already raised a HI case with ServiceNow; however, we have not yet received a clear resolution or explanation. Therefore, we wanted to reach out to the community to understand whether others have encountered a similar issue and if there are any recommended approaches to address it.

Any insights or suggestions would be greatly appreciated.

Thanks in advance for your help!

[Ankur Bawiskar]

@VSNow User 

I believe this is one odd case

It's better you wait for the update from ServiceNow

do share the findings here so that it helps future members.

[Tanushree Maiti]

Hi @VSNow User 

When reviewing Instance Scan best practice findings, you may notice that some Out-of-the-Box (OOB) components still contain patterns that are generally considered best practice violations, such as DOM manipulation or using GlideRecord directly in ACL scripts.

Before making any changes, check the version history of the OOB component.

• If the same implementation still exists in the latest OOB version, do not modify it. Since it is part of the current ServiceNow OOB implementation, it should be left unchanged.
• If your instance contains an older version of the OOB component  ( I am guessing , it is your case) and the latest ServiceNow version has already addressed the issue, update the component to match the latest OOB version instead of implementing a custom fix.

This approach helps preserve OOB functionality, reduces upgrade risks, and ensures that any fixes provided by ServiceNow are adopted rather than introducing unnecessary customizations.