# Cross-Site Scripting via LLM Output

> Master the mechanics of Cross-Site Scripting (XSS) via LLM output. Learn how attackers weaponize AI-generated HTML/JS and defend with strict sanitization and CSP.

Canonical: https://codelivly.com/rooms/cross-site-scripting-via-llm-output
Last updated: 2026-10-12

| | |
|---|---|
| Level | Intermediate |
| Category | Cybersecurity |
| Lessons | 3 |
| Estimated time | 30 min |
| XP | 100 |

This module explores how Large Language Models can be manipulated to generate malicious JavaScript or HTML payloads. You will learn how indirect prompt injection and formatting requests lead to Stored and DOM-based XSS, and how to implement robust defenses like DOMPurify, context-aware encoding, and strict Content Security Policies (CSP).

## Lessons

1. What is XSS via LLM Output and Why It Happens (30 min)
2. Crafting Prompts That Produce Malicious HTML/JS (30 min)
3. Guided Lab: Triggering Stored XSS via a Chatbot Response (30 min)

## Related

- [Learning path: Insecure Output Handling and Downstream Attacks](https://codelivly.com/learning-paths/insecure-output-handling-downstream-attacks)
- [All rooms](https://codelivly.com/rooms)