4

This question already has an answer here:

"><style>.ask-title-cell-value input {background:black;color:white;}</style>

This first line is just to demonstrate the XSS.

Related bug: <marquee>XSS hole in timeline page</marquee> - comments are not HTML/XML escaped

There seems to be unescaped HTML in the question suggestions. I noticed this when this question popped up in my suggestions, and all of a sudden the entire page turned red.

You can check this out by either putting "CSS3 selector for “not A and not B”?" as question title on non-meta SO, or "XSS security problems" on here (and then waiting for the suggestions to load). The "Questions that may already have your answer" box will then load any HTML in the question title, and on the first lines of the question's content (since that's loaded into the link's title="" attribute).

Demonstration picture:

Demonstration

marked as duplicate by Tim Stone, Martijn Pieters, ʞunɥdɐpɐɥd, Adam Lear Jan 8 '14 at 16:24

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 5
    Heh, using the title of this question as a test case brings both this question and the marquee one up, causing all sorts of fun... – Tim Stone Jan 8 '14 at 16:16

Browse other questions tagged .