XSS
Cross-Site Scripting (XSS) is a web security flaw letting attackers run malicious code in a user's browser through a trusted website.
Cross-Site Scripting, or XSS, is a type of online attack. It happens when a hacker finds a way to put bad code, like JavaScript, onto a website that many people visit.
When you visit that website, your browser sees the bad code and runs it, thinking it's from the website itself. This bad code can then steal your information, like login details, or make you do things you didn't intend, like sending spam messages.
Cross-Site Scripting (XSS) is a vulnerability where an attacker injects malicious scripts into content delivered to a user's browser. These scripts execute with the privileges of the user and the domain of the vulnerable website, enabling actions like session hijacking, credential theft, or defacement. XSS attacks are typically categorized into stored, reflected, and DOM-based, depending on how the malicious script is delivered and executed.
This term is relevant as AI models are increasingly used to review code for security vulnerabilities. Tools like Anthropic's Claude Security beta aim to detect and fix issues like XSS before they can be exploited.
- Use Claude SecurityAnthropic · Claude Help Center ·
- Anthropic Claude
- Anthropic's Claude Security beta scans code for vulnerabilities, including XSS, and suggests patches.
- SQL Injection
- SQL Injection attacks target databases by inserting malicious SQL
- CSRF
- Cross-Site Request Forgery (CSRF) tricks a user's browser into making unwa
The term XSS was coined in the late 1990s within the web security community. The name is a deliberate shortening of 'Cross-Site Scripting' to avoid confusion with CSS (Cascading Style Sheets). Source ↗
While direct XSS exploitation is complex and potentially harmful, you can observe its effects by looking for security advisories related to popular websites. Many sites detail past XSS vulnerabilities and how they were fixed, illustrating the potential impact.
The Playbook: reusable how-tos, prompts, configs and tips pulled out of the news.
- PromptRole-play a student struggling with math for AI tutor simulationSimulate a student's math struggles and uncertainty for AI tutor evaluation. · 5 min
- TemplateReusable workflow templates for healthcare teamsTeams can create and share templates for common workflows like documentation or prior authorizations. · 15 min
- TemplateTemplate for building an AI tool tailored to your workA structured approach to defining and building a custom AI tool for specific business needs. · 15 min
- TemplateEvals CSV prompt list for agent skillsA CSV file template for listing prompts used in evaluating agent skills. · 20 min
- HeuristicDouble coding agent task completion with docs linksProviding coding agents with a documentation link significantly increases their task completion rate. · 2 min
Questions people ask
- What is the difference between stored and reflected XSS?
- Stored XSS occurs when malicious script is permanently stored on the target server (e.g., in a database or forum post). Reflected XSS happens when the script is embedded in a URL or other input that is immediately reflected back to the user without being stored.
- How can I prevent XSS attacks?
- Preventing XSS involves input validation (sanitizing user input), output encoding (ensuring data displayed in the browser is treated as text, not code), and using Content Security Policy (CSP) headers.
First seen on Subvolts Sep 3, 2026. Updated Sep 14, 2026. Written by an AI model from the items above and reviewed against them weekly; report an error.