highXSS
3 min read2026-06-10
Stored XSS via Markdown image onerror in a comment field
AN
anon
security researcher · vault ocean
The sanitizer allowed img tags but not their attributes — except onerror slipped through a parser quirk.
A permissive Markdown-to-HTML step ran before sanitization, and a parser edge case let an onerror handler survive. Fix: sanitize the final HTML with a strict allow-list (rehype-sanitize), never trust attribute filtering by denylist.
You read it — record it
sign in to record this and keep your streak alive
Reading earns +25ƒ and keeps your streak alive.
AN
Written by
anon
Security researcher · Vault Ocean contributor