Cross-Site Scripting (XSS)

Overview

Cross-Site Scripting (XSS) is a web vulnerability in which untrusted content is executed as script or active browser content within another user’s trusted application context. Its operational purpose is to describe attacks that can steal sessions, alter payment details, impersonate users, capture data, or perform actions with the victim’s privileges. It should be considered alongside Command Injection. The relevant distinction is content spoofing, which may change displayed information without executing script, and server-side command injection, which targets the operating system rather than the browser.

A typical workflow is as follows: Untrusted data reaches an HTML, attribute, JavaScript, URL, CSS, or DOM sink without context-appropriate handling. The victim’s browser interprets the payload as active content under the application’s origin.

Core controls include framework-safe rendering, contextual output encoding, HTML sanitization, safe DOM APIs, Content Security Policy, secure cookies, dependency updates, code review, and automated testing.

In payment and crypto operations, XSS in a checkout or dashboard can replace wallet addresses, alter amounts, steal administrator sessions, read sensitive page data, or approve unauthorized actions.

Evidence should include affected input and sink, payload, page context, browser behavior, session impact, modified transaction details, code path, logs, exploit scope, and remediation verification. Generic input filtering is insufficient because safe handling depends on the exact browser context where data is rendered.

It is used to describe attacks that can steal sessions, alter payment details, impersonate users, capture data, or perform actions with the victim’s privileges. It differs from content spoofing, which may change displayed information without executing script, and server-side command injection, which targets the operating system rather than the browser.