# XSS Web Injection - HTML Event Handler and Expression with JavaScript Alert

- **Severity:** High
- **Signature ID:** `616e9d2e-083f-413a-af7c-4b8b3d5171ed`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.000 (Direct)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This rule flags attempts to sneak classic XSS attack code into content that gets fed to an AI system, hoping the AI will pass it along unfiltered to a web page or user interface. The payloads use HTML event handlers and CSS tricks combined with javascript:alert calls, often disguised with encoding to slip past filters.

## How the attack works

An attacker crafts input containing HTML attributes like onmouseerror or onmouseleave, or CSS expression() calls, paired with a javascript: protocol call such as alert(). These are embedded in tags like img or anchor links, sometimes with encoded whitespace bytes or protocol-prefix variations designed to dodge simple string matching. The goal is to get an AI agent to reproduce this content somewhere it will actually execute, such as a rendered web page, chat widget, or document viewer. This is a known technique catalogued in security testing corpora for probing whether AI systems filter dangerous web content.

## Why it matters

If the AI agent's output is later rendered as HTML or JavaScript without sanitization, the injected script can run in a victim's browser, enabling session hijacking, credential theft, or unauthorized actions on their behalf.

## What you can do

- Never render AI-generated text as raw HTML or JavaScript without sanitization or escaping.
- Apply an output encoding/sanitization library to any AI response before it reaches a browser or webview.
- Review flagged content manually if it originates from legitimate security research or code review contexts to avoid blocking benign discussion.
- Restrict AI agents that generate or relay web content from having direct write access to rendered pages or client-side execution contexts.

## Known benign look-alikes

- Security research CTF writeups discussing XSS payloads in educational text
- Code review samples of sanitization failures in backtick code blocks

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00476

---
Source: https://www.netzilo.com/threats/atr-xss-web-injection-html-event-handler-and-expression-with-jav