IMG onerror XSS Injection via Indirect Prompt Injection

How the attack works

An attacker embeds hidden instructions in content that an LLM-powered agent will process, such as a webpage, document, or user-submitted data. The instructions tell the model to output an <img> tag with a src pointing to a nonexistent file and an onerror attribute containing JavaScript. Because the image fails to load, the onerror handler fires automatically. If the agent's output is rendered as live HTML in a web interface rather than shown as plain text, the script executes in the browser of whoever views that output.

Netzilo detection

Why it matters

An organization can lose control of a user's browser session when an AI agent's output is trusted and rendered as HTML — this can lead to session hijacking, data theft from the page, or further malicious actions performed as the victim.

What you can do

• →Never render LLM output as raw HTML in a browser; treat it as untrusted text and escape or sanitize it before display.
• →Strip or neutralize event-handler attributes (onerror, onload, etc.) from any HTML the model produces, even if the tag itself looks harmless.
• →Apply a strict Content Security Policy to any interface that displays AI-generated content, disallowing inline script execution.
• →Review any pipeline that lets an LLM ingest external or third-party content (web pages, documents, tickets) for instructions and then reflect that content back into a rendered UI.

Known benign look-alikes

• Security education text discussing img onerror XSS as a concept without injection payload
• Legitimate HTML with img elements that have benign onerror fallback handlers

References

• https://agentthreatrule.org/en/rules/ATR-2026-01451
• https://www.withsecure.com/en/expertise/research-and-articles/llm-xss

Related threats