Software Engineering · Security
An attack where malicious scripts get injected into a page and run in other users' browsers — usually by storing attacker-controlled input that the app then renders as HTML.
Example: A comment field that renders raw HTML lets an attacker inject a script that steals session cookies.
In practice: The fix is escaping or sanitizing output at render time. Most modern frontend frameworks do this by default, which is one of the reasons raw innerHTML is treated as dangerous.