XSS Web Injection - Script Tag with JavaScript Alert Payload
This rule flags text containing classic cross-site scripting (XSS) attack strings, like script tags calling alert(), including versions disguised with invisible or encoded characters. These payloads are often used to test whether an AI system's content filters can be tricked into passing along malicious script content.
How the attack works
An attacker submits input containing a script tag with a JavaScript alert call, either in plain form or with special encoded bytes (invisible spaces, protocol prefixes) inserted before the payload to dodge simple text filters. If the AI agent processes this input and reflects it back or passes it to a downstream system that renders HTML, the script can execute in whatever context receives it. The encoded-prefix tricks exist specifically because naive filters look for exact strings like '<script>' and miss byte-obfuscated variants. This pattern matches known test payloads from the garak security-testing tool's web injection probes.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- bdc2be52-f3d5-4d65-a90b-465506b4893c
- Severity
- High
Why it matters
If successful, this could let an attacker run arbitrary JavaScript in a browser or interface that trusts the AI agent's output, potentially leading to session hijacking, data theft, or defacement wherever that output is displayed.
What you can do
- →Never render AI agent output as raw HTML in a browser or UI without sanitization, regardless of what filtering happened upstream.
- →Use an output encoding or sanitization library (not custom regex filters) on any content that will be displayed in a web context.
- →Treat detections in security research, CTF, or code-review discussions as likely false positives and check the surrounding context.
- →Log and review repeated encoded-prefix variants, since their presence suggests deliberate filter-bypass testing rather than accidental input.
Known benign look-alikes
- Security research or CTF writeups discussing XSS payloads in educational text
- Code reviews discussing sanitization failures with example payloads in backtick code blocks