Tested fixes for CWE-79 in Express, Flask, Spring Boot, ASP.NET Core, Next.js, Django, net/http, Rails and Laravel: the vulnerable code, the fix, a plausible fix that still fails, and the regression tests.
MITRE’s description of CWE-79: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Common consequences MITRE lists
- Access Control, Confidentiality: Bypass Protection Mechanism; Read Application Data
- Integrity, Confidentiality, Availability: Execute Unauthorized Code or Commands
- Confidentiality, Integrity, Availability, Access Control: Execute Unauthorized Code or Commands; Bypass Protection Mechanism; Read Application Data
Script injected into a page runs in your origin with the victim’s session: it can read what they see, call your APIs as them and change the interface they trust.
- Encode untrusted data for its exact output context (HTML text, attribute, URL, JavaScript or CSS) and keep the template engine’s automatic escaping on.
- Avoid raw HTML sinks such as
innerHTMLand framework escape hatches; when rich text is required, sanitize it with a maintained allowlist sanitizer after every transformation step. - Check the scheme of user-supplied links so that
javascript:URLs never reach anhreforsrc. - Add a nonce- or hash-based Content Security Policy and Trusted Types as defense in depth, not as the main control.
Guides on this site
Prevent XSS at the output boundary
Choose text rendering, context-aware encoding, or deliberate HTML sanitization according to how the browser will interpret the value.
Render rich text without granting it application privileges
Choose text rendering or a restricted HTML policy, then test the final DOM after every transformation.
Configure CORS and CSP around the browser capabilities you need
Control who can read API responses and which resources a page may execute without confusing either control with authorization.
Keep generated output out of executable contexts
Choose safe rendering and narrow operations so model text cannot become browser code, database syntax or an unrestricted command.
Prevent DOM XSS, postMessage abuse and client-side injection
Trace attacker-controlled values from the URL, messages and storage to the browser APIs that parse HTML or run code, then close those sinks with safe APIs, a sanitizer, Trusted Types and strict message checks.
Apply CISA Secure by Design: principles, pledge goals and evidence
What CISA's Secure by Design guidance and pledge ask of software manufacturers as of October 2026, and how to turn each of the three principles, the seven pledge goals and the Product Security Bad Practices into engineering actions, metrics and evidence.
Worked threat model: an LLM agent with tools
A complete worked threat model for an LLM agent with tools: the data-flow diagram, the threats from prompt injection, excessive agency, data exfiltration, confused-deputy and memory poisoning, and the mitigations, mapped to the OWASP Top 10 for LLM Applications 2026 and the OWASP Top 10 for Agentic Applications 2026.
Practice
- XSS lab: Render a model’s answer as text instead of active markup · Browser lab
- CORS policy lab: Grant CORS to the right origins only · Browser lab
- CSP builder lab: Build a strict Content-Security-Policy · Browser lab
- HTML sanitization lab: Configure a sanitizer for user comments · Browser lab
- Run model-generated Python in a locked-down container · Local project
References
- CWE-79 in the MITRE CWE list (version 4.20)
- 2025 CWE Top 25 Most Dangerous Software Weaknesses (MITRE CWE Program)
- OWASP Cross Site Scripting Prevention Cheat Sheet
- OWASP DOM Based XSS Prevention Cheat Sheet
List data from MITRE; the name, definition and consequences are from MITRE’s CWE 4.20 catalogue. A guide is listed as the main subject when the weakness is what the guide is about, and as covering it when a dedicated section or worked example addresses it.
CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.