A7: Cross-Site Scripting (XSS) · 2017
Attacker-controlled content executes as code in another person's browser, allowing session theft, impersonation or changes to the interface.
Summary
Attacker-controlled content executes as code in another person's browser, allowing session theft, impersonation or changes to the interface.
How the attack works
A comment is inserted as unescaped HTML; the browser interprets user content as code within the site.
Example
Vulnerable · Pseudocodecomment = request.body["comment"]
comments.save(comment)
feed.innerHTML = comments.latest()Fix: Use textContent or contextual escaping; sanitize permitted HTML and add CSP as defense in depth.
Prevention
- Encode output for its HTML, attribute, URL or JavaScript context.
- Use templates with automatic escaping and sanitize HTML when necessary.
- Apply a restrictive Content Security Policy as an additional defense.
Lineage
- 2013 · A1: Injection Continues in 2017
- 2013 · A3: Cross-Site Scripting (XSS) Moves down to rank 7 in 2017
- 2017 · A1: Injection Continues
- 2017 · A7: Cross-Site Scripting (XSS) Integrated into Injection
- 2021 · A03: Injection Absorbs XSS
- 2025 · A05: Injection Moves down from rank 3
- 2013:A1 → 2017:A1: Injection retains rank 1.
- 2013:A3 → 2017:A7: XSS moves down from rank 3 to 7.
- 2017:A1 → 2021:A03: Injection moves down from rank 1 to 3.
- 2017:A7 → 2021:A03: XSS is integrated into Injection.
- 2021:A03 → 2025:A05: Injection moves down from rank 3 to 5.