The recent chat feature that was added recently has a XSS flaw in it. For testing purpose, I created a chat room called <b>123</b> and as you can see in the screenshot below, the <b> tags weren't escaped.

alt text

  • 9
    You should probably illustrate the importance of this bug by making a chat room that causes people on meta to automatically upvote this post Commented Oct 11, 2010 at 16:09

1 Answer 1


Nice catch. I guess someone owes you a beer next time you meet in The Tavern<script>alert('General')</script>.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .