# Encoding Obfuscation - HTML Event Handler XSS with Encoded Whitespace

- **Severity:** High
- **Signature ID:** `b2df1ae1-241c-4d3d-adc3-3d05923cd687`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.000 (Direct)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This rule spots cross-site scripting (XSS) payloads that use HTML event handlers or CSS expression() to run JavaScript, disguised with backslash-hex encoded whitespace or control characters like \x0B or \xE2\x80\x89. The encoding trick is meant to slip past filters that only look for plain spaces or standard payload formats.

## How the attack works

An attacker crafts an HTML attribute such as onmouseleave or onerror, or a CSS expression(), containing a javascript:alert() style payload. Instead of using a normal space to separate the payload from surrounding markup, they insert an encoded byte sequence (vertical tab, device control character, thin space, etc.) that browsers or parsers still treat as whitespace. This lets the payload pass through naive filters or web application firewalls that pattern-match on literal spaces or known payload strings, while still executing when rendered. The rule flags this specific obfuscation technique regardless of which input channel delivered it.

## Why it matters

If the payload reaches an agent or application that renders it as HTML or CSS, it can execute arbitrary JavaScript in that context, potentially hijacking sessions, exfiltrating data, or manipulating what an AI agent sees and acts on.

## What you can do

- Sanitize and normalize all encoded whitespace and control characters before running any filter or WAF logic on user-supplied HTML or CSS.
- Strip or neutralize HTML event handler attributes and CSS expression() syntax from any content rendered from untrusted input.
- Review logs for the same payload family described in ATR-2026-00476, since both rules catch overlapping attack content from different entry points.
- Treat CTF writeups or code samples containing these payloads as expected false positives, but confirm they are static text and not live, executable input.

## Known benign look-alikes

- Security research CTF writeups discussing XSS payloads in educational text
- Code review samples discussing encoding obfuscation techniques

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00489

---
Source: https://www.netzilo.com/threats/atr-encoding-obfuscation-html-event-handler-xss-with-encoded-whi