Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 157 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

Copy paste following in browser bar,"><script>alert(1)</script>"&tags="></a></div><script>alert(/1/)</script><foo+bar="


test link (might work, but not sure)

  • but firefox 3.6 without noscript, executed my xss.
  • opera 11, executed my xss
  • chrome somehow does not execute alert, but UI is broken,

Found out tag description field is not html escaped.

share|improve this question
Confirmed in Chrome 10 on Windows 7. Great catch. – Pëkka Mar 12 '11 at 18:38
No repro in Chrome 11 dev, but reproduced in Firefox 4's latest nightly. (Windows 7) – nyuszika7h Mar 12 '11 at 18:40
I did get an alert in Chrome 9, Gentoo. Did Chrome add fanciness to detect stuff like this? – Michael Mrozek Mar 12 '11 at 18:49
@Michael, I don't know but In html source, there is plain <script tag, but somehow, my chrome 11 also can't get executed somehow. – YOU Mar 12 '11 at 18:54
Does not give an alert in Chrome 10 on Mac OS X. – Felix Mar 12 '11 at 18:57
@Michael I've turned on XSS protection in about:flags, though it disappeared in Chrome 11. – nyuszika7h Mar 12 '11 at 18:59
@Nyuszika7H, does the bounty imply this still needs fixing? – Arjan Apr 26 '11 at 20:32
@Arjan Nope, I just wanted to give some credit to balpha for that Hacker badge, even if it's not real! :) – nyuszika7h Apr 27 '11 at 5:21
@YOU Confirmed in Firefox 4 on Mac. With NoScript turned on, it's detected at as an XSS attempt as well. – Blowski Apr 27 '11 at 16:30
@Blowski, Actually, this supposed to be fixed already. Edit: Checked and confirmed on my firefox with NoScript too. Probably NoScript alerting everything with <script> tag in url – YOU Apr 27 '11 at 16:31
@YOU Yes, just checked with NoScript disabled and it's fine. Good to know that's what NoScript does... – Blowski Apr 27 '11 at 16:38
up vote 9 down vote accepted

Just imagine it's a real one – it's for you:

Hacker badge

share|improve this answer
cool!, very quick response, thanks, I now like to have that badge :D – YOU Mar 12 '11 at 18:59
Hm, so alert(false) doesn't count for the Hacker badge? – badp Mar 13 '11 at 13:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .