security vulnerability_error ai_generated true

XSS: reflected user input in HTML response

ID: security/xss-reflected

Also available as: JSON · Markdown
85%Fix Rate
88%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

User input reflected in HTML without proper encoding.

generic

Workarounds

  1. 92% success Use context-aware output encoding (HTML, JS, URL, CSS)
  2. 90% success Set Content-Security-Policy header to restrict inline scripts

Dead Ends

Common approaches that don't work:

  1. Filter script tags only 82% fail

    Bypassed with event handlers, SVG, etc.

  2. Use regex to remove HTML 80% fail

    Regex cant reliably parse HTML