# IMG onerror XSS Injection via Indirect Prompt Injection

- **Severity:** High
- **Signature ID:** `d0828e78-0647-4d91-904d-ed12caec340b`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

An attacker plants malicious text somewhere an AI system will read it — a document, webpage, or other data source — instructing the AI to output an HTML image tag with a broken link and a JavaScript error handler. If the AI's response is displayed in a browser without sanitization, the injected script runs in the viewer's session.

## How the attack works

An attacker embeds hidden instructions in content that an LLM-powered agent will process, such as a webpage, document, or user-submitted data. The instructions tell the model to output an <img> tag with a src pointing to a nonexistent file and an onerror attribute containing JavaScript. Because the image fails to load, the onerror handler fires automatically. If the agent's output is rendered as live HTML in a web interface rather than shown as plain text, the script executes in the browser of whoever views that output.

## Why it matters

An organization can lose control of a user's browser session when an AI agent's output is trusted and rendered as HTML — this can lead to session hijacking, data theft from the page, or further malicious actions performed as the victim.

## What you can do

- Never render LLM output as raw HTML in a browser; treat it as untrusted text and escape or sanitize it before display.
- Strip or neutralize event-handler attributes (onerror, onload, etc.) from any HTML the model produces, even if the tag itself looks harmless.
- Apply a strict Content Security Policy to any interface that displays AI-generated content, disallowing inline script execution.
- Review any pipeline that lets an LLM ingest external or third-party content (web pages, documents, tickets) for instructions and then reflect that content back into a rendered UI.

## Known benign look-alikes

- Security education text discussing img onerror XSS as a concept without injection payload
- Legitimate HTML with img elements that have benign onerror fallback handlers

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01451
- https://www.withsecure.com/en/expertise/research-and-articles/llm-xss

---
Source: https://www.netzilo.com/threats/atr-img-onerror-xss-injection-via-indirect-prompt-injection