What are cross-site scripting vulnerabilities?

In their alert, CISA and the FBI define XSS vulnerabilities as those flaws that “arise when manufacturers fail to properly validate, sanitize, or escape inputs. These failures allow threat actors to inject malicious scripts into web applications, exploiting them to manipulate, steal, or misuse data across different contexts.”

An XSS vulnerability is “any opportunity that you have to not sanitize data, and then it gets used in some other capacity,” Tim Mackey, head of software supply chain risk strategy at the Synopsys Software Integrity Group, tells CSO. “This is essentially, ‘Can I put HTML script tags in things? Can I go and render human-provided data in a context in which it wasn’t supposed to be used?’”

Fundamentally, the problem with XSS is the constant need to sanitize data input by users so that it does not get interpreted as HTML code that can transfer to other sites. “In cross-site scripting, when you display something, you have to make sure that if it’s coming from a user, that you’re escaping it, so that it doesn’t get interpreted as HTML code and executed in the context of that website,” Yves Younan, who leads the vulnerability discovery & research team at Cisco Talos, tells CSO.