# Cross-site scripting (XSS) in agent / MCP rendered output

- **Severity:** High
- **Signature ID:** `d085f03c-2feb-425a-9c4a-6dcc72d0f11f`
- **CVEs:** CVE-2025-62800, CVE-2026-21866, CVE-2026-27740, CVE-2026-44429
- **MITRE ATLAS:** AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM02 (Sensitive Information Disclosure)

## Summary

An AI agent or MCP tool can be tricked into producing text that gets displayed in a web interface without being cleaned first. If that text contains malicious script code, it runs in the viewer's browser and can steal login sessions or cookies.

## How the attack works

An attacker feeds the agent input designed to make it output HTML or JavaScript, such as an image tag with an onerror handler, a javascript: link, or a script block that reads document.cookie. The agent's response is rendered directly in a web UI that trusts agent output as safe. Because the payload uses specific triggering shapes — event handlers, javascript: URIs, or cookie-reading scripts — rather than an obvious bare script tag, it can slip past simple filters that only look for that one pattern. When a user views the rendered output, the browser executes the injected code, sending session tokens or credentials to the attacker.

## Why it matters

An organisation can lose user sessions, authentication tokens, or credentials, letting an attacker impersonate victims or access accounts tied to the compromised web UI.

## What you can do

- Treat all agent/MCP output as untrusted user input and HTML-encode or sanitise it before rendering in any web page.
- Apply a strict Content Security Policy that blocks inline scripts and javascript: URIs.
- Sanitise with an allowlist-based library rather than blocking only bare <script> tags, since payloads use event handlers and other shapes.
- Review sessions where agent output included event handlers, javascript: schemes, or cookie references, even if a naive script filter passed them.

## Known benign look-alikes

- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00571
- https://github.com/jlowin/fastmcp/security/advisories
- https://nvd.nist.gov/vuln/detail/CVE-2025-62800
- https://nvd.nist.gov/vuln/detail/CVE-2026-44429
- https://nvd.nist.gov/vuln/detail/CVE-2026-27740
- https://nvd.nist.gov/vuln/detail/CVE-2026-21866

---
Source: https://www.netzilo.com/threats/atr-cross-site-scripting-xss-in-agent-mcp-rendered-output