XSS Web Injection - HTML Event Handler and Expression with JavaScript Alert
This rule flags attempts to sneak classic XSS attack code into content that gets fed to an AI system, hoping the AI will pass it along unfiltered to a web page or user interface. The payloads use HTML event handlers and CSS tricks combined with javascript:alert calls, often disguised with encoding to slip past filters.
How the attack works
An attacker crafts input containing HTML attributes like onmouseerror or onmouseleave, or CSS expression() calls, paired with a javascript: protocol call such as alert(). These are embedded in tags like img or anchor links, sometimes with encoded whitespace bytes or protocol-prefix variations designed to dodge simple string matching. The goal is to get an AI agent to reproduce this content somewhere it will actually execute, such as a rendered web page, chat widget, or document viewer. This is a known technique catalogued in security testing corpora for probing whether AI systems filter dangerous web content.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 616e9d2e-083f-413a-af7c-4b8b3d5171ed
- Severity
- High
Why it matters
If the AI agent's output is later rendered as HTML or JavaScript without sanitization, the injected script can run in a victim's browser, enabling session hijacking, credential theft, or unauthorized actions on their behalf.
What you can do
- →Never render AI-generated text as raw HTML or JavaScript without sanitization or escaping.
- →Apply an output encoding/sanitization library to any AI response before it reaches a browser or webview.
- →Review flagged content manually if it originates from legitimate security research or code review contexts to avoid blocking benign discussion.
- →Restrict AI agents that generate or relay web content from having direct write access to rendered pages or client-side execution contexts.
Known benign look-alikes
- Security research CTF writeups discussing XSS payloads in educational text
- Code review samples of sanitization failures in backtick code blocks