Auth and sessions
User content rendered as markup
Text a user typed is inserted into the page as HTML, so a script in a name or comment runs in other users' browsers and can take their session.
TermsAPI (the interface other software calls; tested directly, without the UI in between) · cross-site request forgery (another site making a user's browser send a state-changing request with the user's cookies) · cross-site scripting (user-typed text rendered as markup, so a script in a name or comment runs in other users' browsers) · two-user test (sign in as one user, create a row, then try to read or change it as another user; pass is nothing comes back)
highseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
Veracode found generated code failed to defend against cross-site scripting in 86% of relevant samples; CodeRabbit measured XSS issues up to 2.74 times more frequent in AI-co-authored pull requests.
AI tools failed to defend against cross-site scripting (CWE-80) in 86% of relevant code samples.
Source: Veracode, 2025-07-30 · verified 2026-09-21 · denominator: code samples where cross-site scripting was relevant, in the Veracode 2025 benchmark
In the same 470-pull-request sample, cross-site scripting issues were up to 2.74 times more frequent in AI-co-authored pull requests; error-handling gaps were nearly 2 times more common and logic and correctness issues 75% more common.
Source: CodeRabbit, 2025-12-17 · verified 2026-09-21
How we detect it
Submit script and event-handler payloads through every free-text field and view each screen that displays them.
Most associated with
Tools: Cursor, GitHub Copilot, Claude Code, Windsurf, Lovable, Bolt
Stacks: Next.js, React Native, Expo
Checklist items that catch it
User-supplied content renders inert
automated Submit script, event-handler and URL payloads through every free-text field and view every screen that displays them.
No payload executes on any screen; content displays as text.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.