XSS: Beating HTML Sanitizing Filters - Port Swigger
Summary: PortSwigger's research on HTML sanitizing filters describes how applications HTML-encode key characters such as < and > or strip expressions like <script> to block cross-site scripting. It shows that filters replacing only the first instance, failing to strip recursively, or mishandling the order of sanitizing steps can be bypassed, as with the payload <scr<script>ipt>alert(1)</script> executing a script.
What you should know: A filter that strips <script> only once, or not recursively, still lets an attacker land a working payload, so the presence of sanitization says nothing about whether it holds.
Read the original at PortSwigger Research ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026